Advisories

CERT-In Advisory CIAD-2009-0052

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: November 11, 2009

Severity Rating: High

Systems Affected

Windows 2000 SP4
Microsoft Windows XP
Windows XP Professional x64 Edition
Windows Server 2003
Windows Server 2003 x64 Edition
Windows Server 2003 for Itanium-based Systems
Windows Vista
Windows Vista x64 Edition
Windows Server 2008
Windows Server 2008 x64-based Systems
Windows Server 2008 for Itanium-based System

Component Affected

Microsoft Office Excel
Microsoft Office Word

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS09-063:Vulnerability in Web Services on Devices API Could Allow Remote Code Execution	High	CIVN-2009-0133 Microsoft Web Services on Devices API WSDAPI remote code execution vulnerability
MS09-064:Vulnerability in License Logging Server Could Allow Remote Code Execution	High	CIVN-2009-0134 Microsoft License Logging Server Heap Overflow Vulnerability
MS09-065:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution	High	CIVN-2009-0135 Multiple Vulnerabilities in Microsoft Kernel-Mode Drivers
MS09-066:Vulnerability in Active Directory Could Allow Denial of Service	Medium	CIVN-2009-0136 Microsoft Active Directory LDAP Denial of Service Vulnerability
MS09-067:Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution	High	CIVN-2009-0137 Microsoft Office Excel Remote Code Execution Vulnerabilities
MS09-068:Vulnerability in Microsoft Office Word Could Allow Remote Code Execution	High	CIVN-2009-0138 Microsoft Office Word Remote Code Execution Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin November 2009
http://www.microsoft.com/technet/security/bulletin/ms09-nov.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms09-nov.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India