Advisories

CERT-In Advisory CIAD-2007-0065

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 12, 2007

Severity Rating: High

Systems Affected

Microsoft Windows SMBv2 Code Signing
Microsoft DirectX
Microsoft Windows 2000 Server
Microsoft Windows Vista
Microsoft Windows Macrovision SafeDisc secdrv.sys driver
Microsoft Windows Media File Format
Internet Explorer

Overview

Multiple vulnerabilities have been reported in various components of Microsoft Products: Microsoft Windows Vista, Microsoft Windows 2000 Server, Internet Explorer , Microsoft Windows SMBv2 Code Signing, Microsoft DirectX, Microsoft Windows Macrovision SafeDisc secdrv.sys driver, Microsoft Windows Media File Format

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS07-063:Vulnerability in SMBv2 Could Allow Remote Code Execution	Medium	CIVN-2007-0151 Remote Code Execution Vulnerability in Microsoft Windows SMBv2 Code Signing
MS07-064:Vulnerabilities in DirectX Could Allow Remote Code Execution	High	CIVN-2007-0152 Microsoft DirectX SAMI/WAV/AVI File Parsing Vulnerabilities
MS07-065:Vulnerability in Message Queuing Could Allow Remote Code Execution	Medium	CIVN-2007-0153 Message Queuing Service Remote Code Execution Vulnerability
MS07-066:Vulnerability in Windows Kernel Could Allow Elevation of Privilege	Medium	CIVN-2007-0154 Local Privilege Escalation Vulnerability in Microsoft Windows Vista Kernel ALPC
MS07-067:Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege	Medium	CIVN-2007-0155 Microsoft Windows Macrovision SafeDisc secdrv.sys driver Local Elevation of Privilege vulnerability
MS07-068:Vulnerability in Windows Media File Format Could Allow Remote Code Execution	High	CIVN-2007-0156 Microsoft Windows Media File Format Remote Code Execution vulnerability
MS07-069:Cumulative Security Update for Internet Explorer	High	CIVN-2007-0157 Internet Explorer Multiple Code Execution Vulnerabilities

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December 2007
http://www.microsoft.com/technet/security/bulletin/ms07-dec.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms07-dec.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India