Advisories

CERT-In Advisory CIAD-2011-0061

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: November 09, 2011

Systems Affected

Windows XP SP3
Windows XP Professional x64 Edition SP2
Windows Vista SP2 and prior
Windows Vista x64 Edition SP2 and prior
Windows Server 2003 SP2
Windows Server 2003 x64 Edition SP2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Server 2008 for 32-bit Systems SP2 and prior
Windows Server 2008 for x64-based Systems SP2 and prior
Windows Server 2008 for Itanium-based Systems SP2 and prior
Windows 7 for 32-bit Systems SP1 and prior
Windows 7 for x64-based Systems SP1 and prior
Windows Server 2008 R2 for x64-based Systems SP1 and prior
Windows Server 2008 R2 for Itanium-based Systems SP1 and prior

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS11-083:Vulnerability in TCP/IP Could Allow Remote Code Execution	High	CIVN-2011-0173 Microsoft Windows TCP/IP Stack Integer Overflow Arbitrary Code Execution Vulnerability
MS11-084:Vulnerability in Windows Kernel-Mode Drivers Could Allow Denial of Service	Medium	CIVN-2011-0174 Microsoft Windows True Type Font Parsing Denial of Service Vulnerability
MS11-085:Vulnerability in Windows Mail and Windows Meeting Space Could Allow Remote Code Execution	High	CIVN-2011-0175 Microsoft Windows Mail and Windows Meeting Space Remote Code Execution Vulnerability
MS11-086:Vulnerability in Active Directory Could Allow Elevation of Privilege	High	CIVN-2011-0176 Microsoft Windows Active Directory Authentication Bypass Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin November 2011.
http://technet.microsoft.com/en-us/security/bulletin/ms11-nov

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/ms11-nov

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India