Advisories

CERT-In Advisory CIAD-2010-0064

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: October 15, 2010

Severity Rating: Low

Systems Affected

Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2

Component Affected

Microsoft Office Suites and Software
Microsoft Internet Explorer
Microsoft Word viewer

Overview

Multiple Vulnerabilities in Microsoft Products: Microsoft Windows Server 2008,2003,Microsoft Vista, Microsoft 7, Microsoft Office XP , Office 2003, Office 2007, Office 2010, Microsoft Open XML File Format Converter for Mac, Microsoft Word Viewer & Microsoft Internet Explorer

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS10-071:Cumulative Security Update for Internet Explorer	High	CIVN-2010-0222 Multiple Vulnerabilities in Microsoft Internet Explorer
MS10-072:Vulnerabilities in SafeHTML Could Allow Information Disclosure	Medium	CIVN-2010-0223 Microsoft SharePoint Cross Site Scripting (XSS) Vulnerabilities
MS10-073:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege	Medium	CIVN-2010-0224 Multiple Vulnerabilities in Microsoft Kernel-Mode Drivers
MS10-074:Vulnerability in Microsoft Foundation Classes Could Allow Remote Code Execution	Low	CIVN-2010-0225 Windows Microsoft Foundation Class Document Title Updating Buffer Overflow Vulnerability
MS10-075:Vulnerability in Media Player Network Sharing Service Could Allow Remote Code Execution	High	CIVN-2010-0226 Microsoft Windows Media Player Real Time Streaming Protocol (RTSP) Use After Free Vulnerability
MS10-076:Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution	High	CIVN-2010-0227 Microsoft Windows Embedded OpenType Font Engine Integer Overflow Vulnerability
MS10-077:Vulnerability in .NET Framework Could Allow Remote Code Execution	High	CIVN-2010-0228 Microsoft .NET Framework Could Allow Remote Code Execution vulnerability
MS10-078:Vulnerabilities in the OpenType Font (OTF) Format Driver Could Allow Elevation of Privilege	Medium	CIVN-2010-0229 Microsoft Windows Open Type Font (OTF) Format Driver Elevation of Privilege Vulnerabilities
MS10-079:Vulnerabilities in Microsoft Word Could Allow Remote Code Execution	Medium	CIVN-2010-0230 Multiple Remote code Execution Vulnerabilities in Microsoft Office Word
MS10-080:Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution	Medium	CIVN-2010-0231 Microsoft Office Excel Remote Code Execution Vulnerability
MS10-081:Vulnerability in Windows Common Control Library Could Allow Remote Code Execution	Medium	CIVN-2010-0232 Microsoft Windows heap-based buffer-overflow Vulnerability
MS10-082:Vulnerability in Windows Media Player Could Allow Remote Code Execution	Medium	CIVN-2010-0233 Microsoft Windows Media Player Vulnerability
MS10-083:Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution	Medium	CIVN-2010-0150 Microsoft Office COM Validation Code Execution Vulnerability
MS10-084:Vulnerability in Windows Local Procedure Call Could Cause Elevation of Privilege	Medium	CIVN-2010-0234 Microsoft Windows Local Procedure Call Privilege Elevation vulnerability
MS10-085:Vulnerability in SChannel Could Allow Denial of Service	Medium	CIVN-2010-0235 Microsoft Windows SChannel TLSv1 Remote Denial of Service vulnerability
MS10-086:Vulnerability in Windows Shared Cluster Disks Could Allow Tampering	Low	CIVN-2010-0236 Microsoft Windows Disk Cluster Tampering Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin October 2010
http://www.microsoft.com/technet/security/bulletin/ms10-oct.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms10-oct.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India