Advisories

CERT-In Advisory CIAD-2006-0037

Multiple Vulnerabilities in Microsoft Windows, Microsoft Office and Microsoft XML Core Services

Original Issue Date: October 11, 2006

Severity Rating: High

Systems Affected

Microsoft Windows Operating Systems
Microsoft Office
Microsoft XML Core Services

Overview

Multiple vulnerabilities have been reported in various components of Microsoft Windows, Microsoft Office and Microsoft XML Core Services. This advisory describes these vulnerabilities addressed by the Microsoft Security Bulletins of October 2006.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS06-056:Vulnerability in ASP.NET Could Allow Information Disclosure	Medium	CIVN-2006-0095 Microsoft .NET Framework 2.0 ASP.NET 2.0 Cross-Site Scripting Vulnerability
MS06-057:Vulnerability in Windows Shell Could Allow Remote Code Execution	High	CIVN-2006-0094 Microsoft Internet Explorer WebViewFolderIcon Buffer Overflow Vulnerability
MS06-058:Vulnerabilities in Microsoft PowerPoint Could Lead to Remote Code Execution	High	CIVN-2006-0096 Microsoft PowerPoint Remote Code Execution Vulnerability
MS06-059:Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution	High	CIVN-2006-0097 Microsoft Excel Malformed DATETIME Record, STYLE Record, Lotus file, COLINFO Record Vulnerabilities
MS06-060:Vulnerability in Microsoft Word Could Allow Remote Code Execution	High	CIVN-2006-0098 Multiple Remote Code Execution Vulnerabilities in Microsoft Word
MS06-061:Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code	High	CIVN-2006-0099 Microsoft XML Core Services vulnerabilities
MS06-062:Vulnerabilities in Microsoft Office Could Lead to Remote Code Execution	High	CIVN-2006-0100 Microsoft Office Multiple Vulnerabilities
MS06-063:Vulnerability in Server Service Could Allow Denial of Service	Medium	CIVN-2006-0101 Denial of Service in Server Service Vulnerability
MS06-064:Vulnerability in TCP-IP IPv6 Could Result in Denial of Service	Low	CIVN-2006-0102 Multiple Denial of Service Vulnerabilities in Microsoft Windows TCP/IP IPv6
MS06-065:Vulnerability in Windows Object Packager Could Allow Remote Execution	Medium	CIVN-2006-0103 Microsoft Windows Object Packager Dialogue Spoofing Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin October 2006
http://www.microsoft.com/technet/security/bulletin/ms06-oct.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms06-oct.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India