More Security Vulnerabilities Affect Word and Excel
Severity: High
12 October, 2010
Summary:
These vulnerabilities affect: All current versions of Microsoft Office for Windows and Mac (specifically Word and Excel)
How an attacker exploits them: Typically, by enticing you to open maliciously crafted Office documents
Impact: An attacker can execute code, potentially gaining complete control of your computer
What to do: Install the appropriate Office patches immediately, or let Windows Update do it for you.
Exposure:
Today, Microsoft released two security bulletins describing 24 vulnerabilities found in components or programs that ship with Microsoft Office for Windows and Mac — more specifically, Word and Excel. Some of the vulnerabilities also affect the viewers, Office Compatibility Packs, and File Format Converters that ship with each program. Each vulnerability affects different versions of Office to a different extent.
The 24 flaws may affect different components and applications within Office, but the end result is always the same. By enticing one of your users into downloading and opening a maliciously crafted Office document, an attacker can exploit any of these vulnerabilities to execute code on a victim’s computer, usually inheriting that user’s level of privileges and permissions. If your user has local administrative privileges, the attacker gains full control of the user’s machine.
According to Microsoft’s bulletins, an attacker can exploit these flaws using two types of Office documents: Word (.doc) and Excel (.xls). So beware of all unexpected documents you receive with these file extensions.
If you’d like to learn more about each individual flaw, drill into the “Vulnerability Details” section of the security bulletins listed below:
MS10-079: Multiple Word Code Execution Vulnerabilities, rated Important
MS10-080: Multiple Excel Code Execution Vulnerabilities, rated Important
Solution Path
Microsoft has released patches for Office to correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately.
Word update for:
Office XP w/SP3
Office 2003 w/SP3
2007 Microsoft Office System w/SP2
Office 2010
Office 2010 64-bit
Office 2004 for Mac
Office 2008 for Mac
Open XML File Format Converter for Mac
Microsoft Office Word Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Microsoft Office Web App
Microsoft Word Web App
Excel update for:
Office XP w/SP3
Office 2003 w/SP3
2007 Microsoft Office System w/SP2
Office 2004 for Mac
Office 2008 for Mac
Open XML File Format Converter for Mac
Microsoft Office Excel Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
For All WatchGuard Users:
While you can configure certain WatchGuard Firebox models to block Word and Excel documents, some organizations need to allow them in order to conduct business. Therefore, these patches are your best recourse. Temporarily though, you may still want to block these Office documents until you are able to install Microsoft’s patches.
If you want to block Word, Excel, and Works documents, follow the links below for video instructions on using your Firebox proxy’s content blocking features to block .doc and .xls files by their file extensions:
Firebox X Edge running 10.x
How do I block files with the FTP proxy?
How do I block files with the HTTP proxy?
How do I block files with the POP3 proxy?
How do I block files with the SMTP proxy
Firebox X Core and X Peak running Fireware 10.x
How do I block files with the FTP proxy?
How do I block files with the HTTP proxy?
How do I block files with the POP3 proxy?
How do I block files with the SMTP proxy?
Status:
Microsoft has released Office updates to fix these vulnerabilities.
References:
MS Security Bulletin MS10-079
MS Security Bulletin MS10-080
This alert was researched and written by Corey Nachreiner, CISSP.
A Dozen Windows Updates Plug 15 Security Holes
Bulletins Affect Media Player, .NET Framework, Kernel-Mode Drivers, and More
Severity: High
12 October, 2010
Summary:
These vulnerabilities affect: All current versions of Windows and components that ship with it (also the .NET Framework)
How an attacker exploits them: Multiple vectors of attack, including sending specially crafted network packets, or enticing your users to websites containing malicious media
Impact: Various results; in the worst case, an attacker can gain complete control of your Windows computer
What to do: Install the appropriate Microsoft patches immediately, or let Windows Automatic Update do it for you.
Exposure:
Today, Microsoft released a dozen security bulletins describing 15 vulnerabilities that affect Windows and components that ship with it. Each vulnerability affects different versions of Windows to varying degrees. However, a remote attacker could exploit the worst of these flaws to gain complete control of your Windows PC. The summary below lists the vulnerabilities, in order from highest to lowest severity.
MS10-075: Media Player Network Sharing Code Execution Vulnerability
Windows Media Player (WMP) is the popular multimedia playback application that ships with Windows. By default, many Windows computers start the Media Player Network Sharing Service, which allows other computers on your network to share media from your computer. However, Windows Vista and 7 do not start this service by default.
According to Microsoft, the Media Player Network Sharing Service that ships with Windows Vista and 7 suffers from a security vulnerability involving the way it handles Real Time Streaming Protocol (RTSP) packets. By sending a specially crafted RTSP packet to a computer with the Network Sharing Service, an attacker can exploit this vulnerability to execute code on that computer under the context of the Network Services account. Though the Network Services account has limited privileges, the attacker could then leverage other vulnerabilities described in this alert to gain complete control of that computer. Typically, Windows only allows computers within your local network to access the Media Player Network Sharing Service, which tends to limit this to an internal threat. Furthermore, Neither Vista nor Windows 7 starts this service by default, which further mitigates this attack.
Microsoft rating: Critical
MS10-076: OpenType Font Engine Integer Overflow Vulnerability
Windows ships with an OpenType Font Engine to handle documents, emails, and web pages that contain OpenType fonts. The OpenType Font Engine suffers from an integer overflow vulnerability that has to do with how it handles certain tables within content that contains OpenType fonts. By luring one of your users into visiting a web page, or opening content that contains maliciously crafted OpenType fonts, an attacker could leverage this flaw to gain complete control of that user’s computer.
Microsoft rating: Critical
MS10-077: Code Execution Vulnerability in .NET Framework 4.0
Microsoft’s .NET Framework is an optional Windows component used to help developers create rich web applications, as well as to display said web content. Windows doesn’t ship with it by default, but many users install it. The 64-bit version of the .NET Framework 4.0 suffers from a code execution vulnerability that has to do with how one of it’s compilers optimizes code incorrectly. By enticing one of your users to a website containing a specially crafted web application, or into running a malicious .NET application, an attacker can exploit this flaw to execute code on that user’s computer, with that user’s privileges. As usual, attackers could gain complete control of the computer if the user has local administrative privileges.
Microsoft rating: Critical
MS10-073 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerabilities
The kernel is the core component of any computer operating system. Windows also ships with a kernel-mode device driver (win32k.sys) which handles many kernel-level devices. This kernel-mode driver suffers from multiple elevation of privilege vulnerabilities. Though these flaws differ technically, they share the same scope and impact. By running a specially crafted program, a local attacker could leverage these flaws to gain complete control of your Windows computers. However, the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of these flaws. That said, despite the lower severity of these flaws, attackers have exploited one of them in the wild — specifically, within the Stuxnet worm, which has received significant media attention.
Microsoft rating: Important
MS10-078: OpenType Font Format Driver Elevation of Privilege Vulnerability
The OpenType Font format driver is another component Windows uses to handle OpenType fonts. The OpenType Font format driver suffers from two elevation of privilege vulnerabilities involving its inability to handle specially crafted OpenType fonts. These flaws are similar in concept to the OpenType Engine flaw described above, except that an attacker needs to locally log into a vulnerable Windows machine, and execute a specially crafted program in order to exploit these flaws. Assuming the attacker can gain access to one of your Windows computers, his malicious program could then leverage either of these flaws to gain complete control of that computer. Granted, these vulnerabilities only affect XP and Server 2003.
Microsoft rating: Important
MS10-081: Common Control Library Buffer Overflow Vulnerability
Windows ships with a library of functions called the Common Control Library (Comctl32.dll), which helps it create the interactive windows it’s know for. This Common Control Library suffers from a heap buffer overflow vulnerability having to do with how it handles Scalable Vector Graphics (SVG) passed to it from 3rd party applications. By enticing your user to a website containing specially crafted code, an attacker could exploit this flaw to execute code on that user’s computer, with that user’s privileges. As usual, attackers could gain complete control of the computer if the user has local administrative privileges.
Microsoft rating: Important
MS10-082 Media Player Code Execution Vulnerability
As mentioned earlier, Windows Media Player (WMP) is the popular multimedia playback application that ships with Windows. Windows Media Player suffers from a second code execution vulnerability that has to do with how it handles web-based media. By enticing one of your users to a website containing specially crafted media, an attacker could gain complete control of that user’s computer. However, the user would have to click through at least one pop-up dialog from the website in order for this attack to succeed. This significantly reduces this flaws’ severity (compared to the first Media Player flaw, which requires no user interaction at all).
Microsoft rating: Important
MS10-083: WordPad and Windows Shell COM Object Code Execution Vulnerability
WordPad is a very basic word processing program and text editor that ships with Windows, and the Windows Shell is the primary GUI component for Windows. Both of these Windows components suffer from a flaw having to do with how they handle COM objects. Without going into technically detail, if an attacker can either entice you to a specially crafted web page, trick you into opening a malicious document with WordPad, or lure you into interacting with a malicious shortcut, he could leverage this flaw to execute code on your computer with your privileges. If you are a local administrator, the attack would gain total control of your computers.
Microsoft rating: Important
MS10-084: LPC Buffer Overflow Vulnerability
Remote Procedure Call (RPC) is a protocol Microsoft Windows uses to allow one computer on a network to execute a task on another computer and then receive the results of that task. Windows RPC also includes a Local Procedure Call (LPC) component, which Windows uses to exchange messages between local processes and threads.The Windows LPC component suffers from a buffer overflow vulnerability involving its inability to handle specially crafted LPC requests. By running a specially crafted program, a local attacker could leverage this flaw to execute code under the context of the Network Services account. Though the Network Services account has limited privileges, the attacker could then leverage other vulnerabilities described in this alert to gain complete control of that computer. However, by their very nature, LPC calls are only sent locally. That means the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of this flaw. Furthermore, this flaw only affects XP and Server 2003.
Microsoft rating: Important
MS10-085: SChannel DoS Vulnerability
The Secure Channel (SChannel) is a Windows security package that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) authentication protocols. According to today’s bulletin, SChannel suffers from a Denial of Service (DoS) vulnerability involving the way it handles specially crafted SSL/TLS handshake requests. By sending an SSL-enabled web server specially crafted requests, an attacker could leverage this flaw to cause your server to stop responding. You’d have to reboot the server to resume service. However, this flaw obviously only affects servers accepting incoming SSL connection — typically IIS web servers with secure pages. Unless you have such servers, and you have allowed the SSL connections through your firewall, you are not vulnerable to this attack.
Microsoft rating: Important
MS10-074: Microsoft Foundation Class Code Execution Vulnerability
Windows ships with a library of functions called the Foundation Class Library, which developers can use to write programs implementing many of Windows’ basic OS and GUI functions. In short, the Foundation Class Library suffers from a vulnerability that has to do with how it handles window titles. If your computer has a 3rd party application that was created using the Foundation Class Library, and that application allows some way for user input to change a windows title, and an external attacker can somehow manipulate the input in a way to change the windows title, he could exploit this flaw to execute code on your computer, with your privileges. As you can tell, that is a lot of “ifs.” Microsoft has established that none of their software is vulnerable to this flaw. So you are only affected by it if you have installed some 3rd party application that was coded in a very specific way. This flaw poses a very low risk.
Microsoft rating: Moderate
MS10-086: Shared Cluster Disk Tampering Vulnerability
Microsoft Cluster Server (MSCS) is a Windows component that allows you to cluster servers and disks. MSCS incorrectly sets permissions when adding news disks to a disk cluster. As a result, an internal attacker that can remotely access the file system of a cluster disk administrative share will have full control of that share, regardless of his privilege. However, usually only users on the local network will have access to disk shares. The flaw only affects Windows Server 2008 R2.
Microsoft rating: Moderate
Solution Path:
Microsoft has released patches for Windows which correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately. If you choose, you can also let Windows Update automatically download and install these for you.
MS10-075:
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows 7
For Windows 7 x64
Note: Other versions of Windows are not affected by this vulnerability.
MS10-076:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
For Windows Server 2008 R2 Itanium
* Note: Server Core installations not affected.
MS10-077:
Microsoft .NET Framework 4.0 Update for all 64-bit versions of Windows.
MS10-073:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2)
For Windows Server 2008 x64 (w/SP2)
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64
For Windows Server 2008 R2 Itanium
MS10-078:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
Note: Other versions of Windows are not affected.
MS10-081:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
For Windows Server 2008 R2 Itanium
* Note: Server Core installations not affected.
MS10-082:
All versions of Windows Media Player for:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
* Note: Server Core installations not affected.
MS10-083:
Updates for WordPad:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
For Windows Server 2008 R2 Itanium
Updates for Windows Shell:
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
For Windows Server 2008 R2 Itanium
* Note: Server Core installations not affected.
MS10-084:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
Note: Other versions of Windows are not affected.
MS10-085:
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2)
For Windows Server 2008 x64 (w/SP2)
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64
For Windows Server 2008 R2 Itanium
Note: Other versions of Windows are not affected.
MS10-074:
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
For Windows 7
For Windows 7 x64
For Windows Server 2008 R2 x64 *
For Windows Server 2008 R2 Itanium
* Note: Server Core installations not affected.
MS10-086:
For Windows Server 2008 R2 x64
For Windows Server 2008 R2 Itanium
Note: Other versions of Windows are not affected.
For All WatchGuard Users:
Attackers can exploit these flaws using diverse exploitation methods. A properly configured firewall can mitigate the risk of some of these issues (the ones that rely on access to local resources). That said, the Firebox cannot protect you from local attacks, nor can it prevent attacks that leverage normal HTTP traffic. Therefore, installing Microsoft’s updates is your most secure course of action.
Status:
Microsoft has released patches correcting these issues.
References:
Microsoft Security Bulletin MS10-073
Microsoft Security Bulletin MS10-074
Microsoft Security Bulletin MS10-075
Microsoft Security Bulletin MS10-076
Microsoft Security Bulletin MS10-077
Microsoft Security Bulletin MS10-078
Microsoft Security Bulletin MS10-081
Microsoft Security Bulletin MS10-082
Microsoft Security Bulletin MS10-083
Microsoft Security Bulletin MS10-084
Microsoft Security Bulletin MS10-085
Microsoft Security Bulletin MS10-086
This alert was researched and written by Corey Nachreiner, CISSP.
Cumulative IE Patch Fixes Ten New Security Flaws
Severity: High
12 October, 2010
Summary: This vulnerability affects: All current versions of Internet Explorer, running on all current versions of Windows How an attacker exploits it: Usually, by enticing one of your users to visit a malicious web page
Impact: Various, in the worst case an attacker can execute code on your user’s computer, potentially gaining complete control of it What to do: Deploy the appropriate Internet Explorer patches immediately, or let Windows Automatic Update do it for you Exposure: In a security bulletin released today as part of Patch Day, Microsoft describes ten new vulnerabilities in Internet Explorer (IE) 8.0 and earlier versions, running on all current versions of Windows (including Windows 7 and Windows Server 2008). Microsoft rates the aggregate severity of these new flaws as Critical.
The ten vulnerabilities differ technically, but four of the most serious ones share the same general scope and impact. These four issues involve various memory corruption flaws having to do with how IE handles certain HTML elements and objects. If an attacker can lure one of your users to a web page containing malicious web code, he could exploit any one of these four vulnerabilities to execute code on that user’s computer, inheriting that user’s privileges. Typically, Windows users have local administrative privileges. In that case, the attacker could exploit these flaws to gain complete control of the victim’s computer.
The remaining vulnerabilities consists of Cross-Site or Cross-Domain Scripting (XSS) flaws and some Information Disclosure issues.
Keep in mind, today’s attackers often hijack legitimate web pages and booby-trap them with malicious code. Typically, they do this via hosted web ads or through SQL injection and XSS attacks. Even recognizable and authentic websites could pose a risk to your users if hijacked in this way.
If you’d like to know more about the technical differences between these flaws, see the “Vulnerability Information” section of Microsoft’s bulletin. Technical differences aside, the memory corruption flaws in IE pose significant risk. You should download and install the IE cumulative patch immediately.
Solution Path:
These patches fix serious issues. You should download, test, and deploy the appropriate IE patches immediately, or let Windows Automatic Update do it for you. By the way, Microsoft no longer supports Windows 2000 and IE 5.x. If you still run a legacy version of IE or Windows, we highly recommend you update in order to get the latest security updates.
Internet Explorer 6.0
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
Internet Explorer 7.0
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Server 2003 Itanium (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows Server 2008 Itanium (w/SP2)
Internet Explorer 8.0
For Windows XP (w/SP3)
For Windows XP x64 (w/SP2)
For Windows Server 2003 (w/SP2)
For Windows Server 2003 x64 (w/SP2)
For Windows Vista (w/SP1 or SP2)
For Windows Vista x64 (w/SP1 or SP2)
For Windows Server 2008 (w/SP2) *
For Windows Server 2008 x64 (w/SP2) *
For Windows 7
For Windows 7 x64
For Windows Server 2008
For Windows Server 2008 x64
- Note: These flaws do not affect Windows Server 2008 administrators who installed using the Server Core installation option.
For All WatchGuard Users:
These attacks travel as normal-looking HTTP traffic, which you must allow if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.
Status:
Microsoft has released patches to fix these vulnerabilities.
References:
MS Security Bulletin MS10-071
This alert was researched and written by Corey Nachreiner, CISSP.
