Advisories

CERT-In Advisory CIAD-2010-0072

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 15, 2010

Component Affected

Internet Explorer
Microsoft Windows OpenType Font (OTF) Driver
Microsoft Task Scheduler
Windows Movie Maker
Windows Media Encoder
Microsoft Windows Kernel-mode Drivers
Microsoft SharePoint
Microsoft Office Graphics
Microsoft Works
Microsoft Exchange Server

Software Affected

Windows Server 2008
Windows 7
Windows Server 2003
Windows Vista
Windows XP

Overview

Multiple Vulnerabilities have been reported in various Microsoft Products: Internet Explorer, Microsoft Windows OpenType Font (OTF) Driver, Microsoft Task Scheduler, Windows Movie Maker, Windows Media Encoder,Microsoft Windows Kernel-mode Drivers, Microsoft SharePoint, Microsoft Office Graphics, Microsoft Exchange Server that leads to denial of service, elevation of privilege or remote code execution in the affected system.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS10-090:Cumulative Security Update for Internet Explorer	High	CIVN-2010-0253 Multiple Vulnerabilities in Microsoft Internet Explorer
MS10-091:Vulnerabilities in the OpenType Font (OTF) Driver Could Allow Remote	High	CIVN-2010-0254 Multiple Vulnerabilities in Microsoft Windows OpenType Font Driver
MS10-092:Vulnerability in Task Scheduler Could allow Elevation of Privilege	Medium	CIVN-2010-0255 Microsoft Windows Task Scheduler service privilege escalation vulnerability
MS10-093:Vulnerability in Windows Movie Maker Could Allow Remote Code Execution	Medium	CIVN-2010-0256 Remote Code Execution Vulnerability� in Microsoft Windows Movie Maker
MS10-094:Vulnerability in Windows Media Encoder Could Allow Remote Code Execution	Medium	CIVN-2010-0257 Remote Code Execution Vulnerability� in Microsoft Windows Media Encoder
MS10-095:Vulnerability in Microsoft Windows Could Allow Remote Code Execution	Medium	CIVN-2010-0258 Microsoft Windows BranchCache Insecure Library Loading
MS10-096:Vulnerability in Windows Address Book Could Allow Remote Code Execution	Medium	CIVN-2010-0259 Vulnerability in Windows Address Book Could Allow Remote Code Execution
MS10-097:Insecure Library Loading in Internet Connection Signup Wizard Could Allow Remote Code Execution	Medium	CIVN-2010-0260 Insecure Library Loading in Internet Connection Signup Wizard
MS10-098:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege	Medium	CIVN-2010-0261 Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
MS10-099:Vulnerability in Routing and Remote Access Could Allow Elevation of Privilege	Medium	CIVN-2010-0262 Microsoft Windows Routing and Remote Access Local Privilege Escalation Vulnerability
MS10-100:Vulnerability in Consent User Interface	Medium	CIVN-2010-0263 Microsoft Windows Consent User Interface Privilege Escalation Vulnerability
MS10-101:Vulnerability in Windows NetLogon Service	Medium	CIVN-2010-0264 Windows Netlogon Service Could Allow Denial of Service Vulnerability
MS10-102:Vulnerability in Windows Hyper-V Could Allow Denial of Service	Medium	CIVN-2010-0265 Microsoft Windows Hyper-V Local Denial of Service Vulnerability
MS10-103:Vulnerability in Microsoft Office Publisher Could Allow Remote Code Execution	Medium	CIVN-2010-0266 Microsoft Office Publisher Multiple Code Execution Vulnerabilities
MS10-104 :Vulnerability in Microsoft Sharepoint could allow Remote Code Execution	Medium	CIVN-2010-0267 Microsoft Office SharePoint Remote Code Execution Vulnerability
MS10-105:Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution	Medium	CIVN-2010-0268 Multiple Vulnerabilities in Microsoft Office Graphics Filters
MS10-106:Vulnerability in Microsoft Exchange Server Could Allow Denial of Service	Medium	CIVN-2010-0269 Microsoft Exchange Server Infinite Loop Denial of Service Vulnerabilit

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December 2010
http://www.microsoft.com/technet/security/bulletin/ms10-dec.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms10-dec.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India