nCircle Resources - VERT Alert - 9 new Microsoft Security Bulletins fixing 21 vulnerabilities.

Solutions

Vulnerability Management Configuration Compliance PCI Regulations Government Consensus Audit Guidelines

IT GRC nCircle Technology Small Businesses CSO Center Secure Everywhere
Products

nCircle PureCloud nCircle Benchmark Suite360 Intelligence Hub Configuration Compliance Manager File Integrity Monitoring

nCircle IP360 WebApp360 PCI Scan Service HITRUST Service
Services

VERT Consulting Services Training
Customers

Testimonials Case Studies
Partners

Suite360 Partner Portal
News

Articles Press Releases Awards Certifications Events
Resources

Data Sheets Case Studies White Papers Regulation Mappings Analyst Reports Bellwether Metrics Security Survey Results

Tools Podcasts Webinars Videos VERT Alert Patch Priority Index
Support

Customer Portal Login
Community

Blog Worldwide User Conference nCircle Viewpoint
Company

Board of Directors Investors Employment Job Openings Contact Us Trust Stewardship

February 14, 2012 4:10 PM (PT)

The nCircle VERT Alert is brought to you by nCircle VERT, nCircle's research team. VERT Alerts are distributed for Microsoft Patch Tuesday and for significant security threats.

Today's VERT Alert addresses 9 new Microsoft Security Bulletins. VERT is actively working on coverage for this bulletin in order to meet our 24-hour SLA and expects to ship ASPL-445 on Wednesday, February 15th.

MS12-008	GDI Access Violation Vulnerability	CVE-2011-5046
MS12-008	Keyboard Layout Use After Free Vulnerability	CVE-2012-0154
MS12-009	AfdPoll Elevation of Privilege Vulnerability	CVE-2012-0148
MS12-009	Ancillary Function Driver Elevation of Privilege Vulnerability	CVE-2012-0149
MS12-010	Copy and Paste Information Disclosure Vulnerability	CVE-2012-0010
	HTML Layout Remote Code Execution Vulnerability	CVE-2012-0011
	Null Byte Information Disclosure Vulnerability	CVE-2012-0012
	VML Remote Code Execution Vulnerability	CVE-2012-0155
MS12-011	XSS in inplview.aspx Vulnerability	CVE-2012-0017
	XSS in themeweb.aspx Vulnerability	CVE-2012-0144
	XSS in wizardlist.aspx Vulnerability	CVE-2012-0145
MS12-012	Color Control Panel Insecure Library Loading Vulnerability	CVE-2012-5082
MS12-013	Msvcrt.dll Buffer Overflow Vulnerability	CVE-2012-0150
MS12-014	Indeo Codec Insecure Library Loading Vulnerability	CVE-2012-3138
MS12-015	VSD File Format Memory Corruption Vulnerability	CVE-2012-0019
	VSD File Format Memory Corruption Vulnerability	CVE-2012-0020
	VSD File Format Memory Corruption Vulnerability	CVE-2012-0136
	VSD File Format Memory Corruption Vulnerability	CVE-2012-0137
	VSD File Format Memory Corruption Vulnerability	CVE-2012-0138
MS12-016	AfdPoll Elevation of Privilege Vulnerability	CVE-2012-0014
MS12-016	.NET Framework Unmanaged Objects Vulnerability	CVE-2012-0015

MS12-008

The first bulletin this month resolves two vulnerabilities affecting the Windows Kernel Mode Drivers. One of these vulnerabilities has been discussed publicly and proof of concept code has been released. Both of these vulnerabilities affect all supported Windows operating systems.

MS12-009

The two vulnerabilities patched by MS12-009 could lead to privilege escalation due to vulnerabilities in the Ancillary Function Driver (AFD.sys). While one of these vulnerabilities (CVE-2012-0149) only affects Windows Server 2003, the other vulnerability (CVE-2012-0148) affects all 64-bit operating systems.

MS12-010

This months Internet Explorer update resolves 4 vulnerabilities. The interesting twist here is that all four vulnerabilities affect Internet Explorer 9, while only one of the four affects IE6.

MS12-011

The fourth bulletin this month fixes three cross-site scripting vulnerabilities affecting SharePoint Server and SharePoint Foundation 2010.

MS12-012

This bulletin is the first of two resolving DLL Preloading issues this month; this one is found in the Color Control Panel.

MS12-013

This bulletin, the most critical after MS12-010, is probably the one that will draw the most attention. Seeing that the C Run-Time is affected is a big deal; luckily the only known attack vector is via Windows Media Player. While that's still a concern, and enough to rank this vulnerability as Critical, it makes it less scary than it could be. Please note that third party software could provide additional attack vectors to hit the vulnerable code. Microsoft has released a blog post that contains additional details as well as guidance for 3rd party application developers.

MS12-014

The second DLL Preloading issue this month affects the Indeo codec, which has been around since 1992 and warranted its own blog post, which is a very interesting read and definitely recommended.

MS12-015

The award for most CVEs in a bulletin this month goes to MS12-015 for five vulnerabilities related to the Visio document format (VSD).

MS12-016

The final bulletin this month affects .NET Framework and Silverlight. One of these two vulnerabilities has been disclosed publicly and the latest versions of this software (.NET 4 and Silverlight 4) are only affected by the other vulnerability.

Other Information

VERT will also be releasing updates to detect the new Adobe Shockwave vulnerabilities reported in APSB12-02

As always VERT recommends that you apply all the patches as soon as possible but also that you fully vet patches (when possible) before applying them to production systems.

Ease of Use (published exploits) to Risk Table:

Automated Exploit			MS12-012 MS12-014
Easy
Moderate						MS12-008
Difficult			MS12-013 MS12-016
Extremely Difficult
No Known Exploit			MS12-010 MS12-011 MS12-015			MS12-009
	Exposure	Local Availability	Local Access	Remote Availability	Remote Access	Local Privileged	Remote Privileged

All data and commentary is based on information available when the VERT Alert is published. The VERT Alert may be updated on the nCircle website as new information surfaces: http://www.ncircle.com/index.php?s=resources_VERT-Alert.


*Email: