| NEW SECURITY BULLETIN TECHNICAL DETAILS |
|
| |
| In the following tables of affected and non-affected software, software editions that are not listed are past their support lifecycle. To determine the support lifecycle for your product and edition, visit the Microsoft Support Lifecycle website at http://support.microsoft.com/lifecycle/. |
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-057 | | Bulletin Title | Cumulative Security Update for Internet Explorer (2559049) | | Executive Summary | This security update resolves five privately reported vulnerabilities and two publicly disclosed vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user.
The update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory, handles JavaScript event handlers, renders data during certain processes, accesses files stored in the local machine, and manages cookie files; and by modifying the way the telnet handler executes the associated application. | | Severity Ratings and Affected Software | This security update is rated Critical for Internet Explorer 6 on Windows clients, and for Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9; and Important for Internet Explorer 6 on Windows servers. | | Attack Vectors | | • | A maliciously crafted webpage. | | • | A maliciously crafted HTML email. | | | Mitigating Factors | | • | Users would have to be persuaded to visit a malicious website. | | • | Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. | | • | Exploitation only gains the same user rights as the logged-on account. | | • | By default, IE on Windows 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode. | | • | By default, all versions of Outlook, Outlook Express, and Windows Mail open HTML email messages in the Restricted Sites zone. | | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | MS11-050 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-057.mspx | | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-058 | | Bulletin Title | Vulnerabilities in DNS Server Could Allow Remote Code Execution (2562485) | | Executive Summary | This security update resolves two privately reported vulnerabilities in Windows DNS server. The more severe of these vulnerabilities could allow remote code execution if an attacker registers a domain, creates an NAPTR DNS resource record, and then sends a specially crafted NAPTR query to the target DNS server.
The security update addresses the vulnerabilities by modifying the way that the DNS server handles NAPTR queries in memory and initializes objects in memory before use. | | Severity Ratings and Affected Software | This security update is rated Critical for 32-bit and x64-based editions of Windows Server 2008, and x64-based editions of Windows Server 2008 R2; and Important for all supported editions of Windows Server 2003. | | Attack Vectors | | • | Specially crafted NAPTR queries to a DNS server. | | • | A maliciously crafted DNS Query. | | | Mitigating Factors | Servers that do not have the DNS role enabled are not at risk. | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | MS09-008, MS09-048, and MS11-046. | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-058.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-059 | | Bulletin Title | Vulnerability in Data Access Components Could Allow Remote Code Execution (2560656) | | Executive Summary | This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a legitimate Excel file (such as an .xlsx file) that is located in the same network directory as a specially crafted library file. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
The security update addresses the vulnerability by correcting the manner in which the Windows Data Access Tracing component loads external libraries. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Windows 7 and Windows Server 2008 R2. | | Attack Vectors | | • | A legitimate Excel-related file. | | • | A maliciously crafted DLL. | | • | A maliciously crafted file share or WebDAV location. | | | Mitigating Factors | | • | An attacker would have no way to force users to visit an untrusted remote file system location or WebDAV share. | | • | SMB is commonly disabled on the perimeter firewall. | | • | Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. | | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | None | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS10-059.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-060 | | Bulletin Title | Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2560978) | | Executive Summary | This security update resolves two privately reported vulnerabilities in Microsoft Visio. The vulnerabilities could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
The security update addresses the vulnerabilities by correcting the way that Microsoft Visio validates objects in memory when parsing specially crafted Visio files. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Microsoft Visio 2003, Microsoft Visio 2007, and Microsoft Visio 2010. | | Attack Vectors | | • | A maliciously crafted Visio file. | | • | Common delivery mechanisms: a maliciously crafted webpage, an email attachment, an instant message, a peer-to-peer file share, a network share, and/or a USB thumb drive. | | | Mitigating Factors | | • | Exploitation only gains the same user rights as the logged-on account. | | • | Cannot be exploited automatically through email, because a user must open an attachment that is sent in an email message. | | • | Users would have to be persuaded to visit a malicious website. | | • | Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. | | | Restart Requirement | This update may require a restart. | | Bulletins Replaced by This Update | MS11-008 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-060.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-061 | | Bulletin Title | Vulnerability in Remote Desktop Web Access Could Allow Elevation of Privilege (2546250) | | Executive Summary | This security update resolves a privately reported vulnerability in Remote Desktop Web Access. The vulnerability is a cross-site scripting (XSS) vulnerability that could allow elevation of privilege, enabling an attacker to execute arbitrary commands on the site in the context of the target user. The XSS Filter in Internet Explorer 8 and Internet Explorer 9 prevents this attack for its users when browsing to a Remote Desktop Web Access server in the Internet Zone. The XSS Filter in Internet Explorer 8 and Internet Explorer 9 is not enabled by default in the Intranet Zone.
The security update addresses the vulnerability by correcting the manner in which the logon page for Remote Desktop Web Access validates input parameters. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Windows Server 2008 R2. | | Attack Vectors | • A maliciously crafted link in an email message or on a website. | | Mitigating Factors | | • | The IE8/9 XSS Filter prevents this attack for IE8/9 users when browsing in the Internet Zone. | | • | Users would have to be persuaded to visit a malicious website. | | • | Remote Desktop Web Access is not installed by default. | | | Restart Requirement | This update may require a restart. | | Bulletins Replaced by This Update | None | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-061.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-062 | | Bulletin Title | Vulnerability in Remote Access Service NDISTAPI Driver Could Allow Elevation of Privilege (2566454) | | Executive Summary | TThis security update resolves a privately reported vulnerability in all supported editions of Windows XP and Windows Server 2003. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability and take complete control over the affected system.
The security update addresses the vulnerability by correcting the way that the NDISTAPI driver validates user mode input prior to sending it to the Windows kernel. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Windows XP and Windows Server 2003. Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are not affected by the vulnerability. | | Attack Vectors | • A maliciously crafted application.
• A maliciously crafted script. | | Mitigating Factors | • An attacker must have valid logon credentials and be able to log on locally to
exploit this vulnerability.
| | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | None | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-062.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-063 | | Bulletin Title | Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (2567680) | | Executive Summary | This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to send a device event message to a higher-integrity process.
The security update addresses the vulnerability by modifying the way that the Client/Server Run-time Subsystem (CSRSS) evaluates inter-process device event message permissions. | | Severity Ratings and Affected Software | This security update is rated Important for all supported versions of Microsoft Windows. | | Attack Vectors | • A maliciously crafted application.
• A maliciously crafted script. | | Mitigating Factors | • An attacker must have valid logon credentials and be able to log on locally to
exploit this vulnerability. | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | MS10-069 and MS11-056. | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-063.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-064 | | Bulletin Title | Vulnerabilities in TCP/IP Stack Could Allow Denial of Service (2563894) | | Executive Summary | This security update resolves two privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow denial of service if an attacker sends a sequence of specially crafted Internet Control Message Protocol (ICMP) messages to a target system or sends a specially crafted URL request to a server that is serving web content and has the URL-based Quality of Service (QoS) feature enabled.
The security update addresses the vulnerabilities by modifying the way that the Windows TCP/IP stack processes ICMP messages and handles URLs in memory when URL-based QoS is enabled. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Windows Server 2008 and Windows Server 2008 R2, and is rated Moderate for all supported editions of Windows Vista and Windows 7. | | Attack Vectors | | • | Maliciously crafted ICMP network packets for CVE-2011-1871. | | • | A specially crafted URL request to a server that is serving web content and has URL-based QoS enabled for CVE-2011-1965. | | | Mitigating Factors | | • | Microsoft has not identified any mitigations for CVE-2011-1871. | | • | URL-based QoS feature is not enabled on any operating system by default. Users would need to manually install this feature in order to be affected by this vulnerability.. | | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | MS10-058 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-064.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-065 | | Bulletin Title | Vulnerability in Remote Desktop Protocol Could Allow Denial of Service (2570222) | | Executive Summary | This security update resolves a privately reported vulnerability in the Remote Desktop Protocol. The vulnerability could allow denial of service if an affected system received a sequence of specially crafted RDP packets. Microsoft has also received reports of limited, targeted attacks attempting to exploit this vulnerability.
The security update addresses the vulnerability by addressing the way that the Remote Desktop Protocol processes packets in memory. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Windows Server 2003 and Moderate for all supported editions of Windows XP. | | Attack Vectors | • A sequence of specially crafted RDP packets. | | Mitigating Factors | | • | By default, Remote Desktop Protocol (RDP) is not enabled on any operating system. | | • | Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. | | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | None | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-065.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-066 | | Bulletin Title | Vulnerability in Microsoft Chart Control Could Allow Information Disclosure (2567943) | | Executive Summary | This security update resolves a privately reported vulnerability in ASP.NET Chart controls. The vulnerability could allow information disclosure if an attacker sent a specially crafted GET request to an affected server hosting the Chart controls. Note that this vulnerability would not allow an attacker to execute code or to elevate the attacker's user rights directly, but it could be used to retrieve information that could be used to further compromise the affected system.
The security update addresses the vulnerability by correcting the manner in which the Chart controls verify functions within specially crafted URIs. | | Severity Ratings and Affected Software | This security update is rated Important for Microsoft .NET Framework 4 on all supported releases of Microsoft Windows and for Chart Control for Microsoft .NET Framework 3.5 Service Pack 1. | | Attack Vectors | • A specially crafted GET request to a server hosting the Chart controls | | Mitigating Factors | | • | Only web applications using Microsoft Chart Control are affected by this issue. | | • | Default installations of the .NET Framework are not affected. | | | Restart Requirement | This update may require a restart. | | Bulletins Replaced by This Update | None | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-066.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-067 | | Bulletin Title | Vulnerabilities in Kerberos Could Allow Elevation of Privilege (2496930) | | Executive Summary | This security update resolves a privately reported vulnerability in Microsoft Report Viewer. The vulnerability could allow information disclosure if a user views a specially crafted webpage. In all cases, however, an attacker would have no way to force a user to visit the website.
The security update addresses the vulnerability by correcting the manner in which the Microsoft Report Viewer control validates parameters within a data source. | | Severity Ratings and Affected Software | This security update is rated Important for all supported editions of Microsoft Visual Studio 2005 and Microsoft Report Viewer 2005 Redistributable Package. | | Attack Vectors | | • | A maliciously crafted link in an email message or on a website. | | • | A maliciously crafted webpage. | | • | A maliciously crafted HTML email. | | | Mitigating Factors | | • | An attacker would have to persuade a user to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes the user to the vulnerable website. | | • | By default, all versions of Outlook, Outlook Express, and Windows Mail open HTML email messages in the Restricted Sites zone. | | • | By default, IE on Windows 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode. | | | Restart Requirement | This update may require a restart. | | Bulletins Replaced by This Update | MS09-092 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-067.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-068 | | Bulletin Title | Vulnerability in Windows Kernel Could Allow Denial of Service (2556532) | | Executive Summary | This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service if a user visits a network share (or visits a website that points to a network share) containing a specially crafted file. In all cases, however, an attacker would have no way to force a user to visit such a network share or website.
The security update addresses the vulnerability by correcting the way that the Windows kernel parses metadata information in files. | | Severity Ratings and Affected Software | This security update is rated Moderate for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. | | Attack Vectors | | • | A file with maliciously crafted metadata information. | | • | A maliciously crafted file share or WebDAV location. | | • | A maliciously crafted webpage. | | | Mitigating Factors | | • | Users would have to be persuaded to visit a malicious website or network share by clicking a link in an email message or Instant Messenger message. | | | Restart Requirement | This update requires a restart. | | Bulletins Replaced by This Update | MS10-047 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-068.mspx | |
|
|
|
| Bulletin Identifier | Microsoft Security Bulletin MS11-069 | | Bulletin Title | Vulnerability in .NET Framework Could Allow Information Disclosure (2567951) | | Executive Summary | This security update resolves a privately reported vulnerability in Microsoft .NET Framework. The vulnerability could allow information disclosure if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites.
This vulnerability could also be used by Windows .NET applications to bypass Code Access Security (CAS) restrictions.
The security update addresses the vulnerability by correcting the manner in which the .NET Framework validates the trust level within the System.Net.Sockets namespace. | | Severity Ratings and Affected Software | This security update is rated Moderate for Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows. | | Attack Vectors | | • | A specially crafted XAML browser application. | | • | A website that contains a specially crafted XAML browser application. | | • | A web hosting environment allows users to upload custom ASP.NET applications. | | | Mitigating Factors | | • | An attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website. | | • | By default, IE on Windows 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode. | | • | In a web-hosting scenario, an attacker must have permission to upload arbitrary ASP.NET pages to a website and ASP.NET must be installed on that web server. | | • | Customers who have installed MS11-044 cannot be exploited without user interaction. | | | Restart Requirement | This update may require a restart. | | Bulletins Replaced by This Update | MS11-039 | | Full Details | http://www.microsoft.com/technet/security/bulletin/MS11-069.mspx | |
| |
| REGARDING INFORMATION CONSISTENCY |
|
| |
We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Microsoft's security content posted to the web is occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in Microsoft's web-based security content, the information in Microsoft's web-based security content is authoritative.
If you have any questions regarding this alert please contact your Technical Account Manager or Application Development Consultant.
Thank you,
Microsoft CSS Security Team
|
