Advisories

CERT-In Advisory CIAD-2012-0053

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: November 14, 2012

Systems Affected

Microsoft Excel 2003, 2007 Service Pack 2 & 3
Microsoft Excel 2010 Service Pack 1 (32-bit editions & 64-bit editions)
Microsoft Office 2008 for Mac
Microsoft Excel Viewer
Microsoft Office Compatibility Pack Service Pack 2 & 3
Windows XP SP 2 & SP 3
Windows 7 for 32-bit & x64-based Systems SP1 and prior
Windows Server 2012
Windows RT
Windows Server 2008 for 32-bit and x64-based Systems SP2
Windows Server 2008 R2 for x64-based Systems SP1 and prior
Windows Server 2008 R2 for Itanium based Systems & SP1
Windows Server 2008 for Itanium-based Systems SP 2
Windows Server 2003 SP 2 and x64 Edition SP 2
Windows Server 2003 with SP2 for Itanium-based Systems '
Windows Vista SP 2 and x64 Edition SP 2

Component Affected

Internet Explorer 9
IIS 7.0 on all supported editions of Windows Vista and Windows Server 2008.
IIS 7.5 on all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
Microsoft .NET Framework 1.0 SP 3
Microsoft .NET Framework 1.1 SP 1
Microsoft .NET Framework 2.0 SP 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4
Microsoft .NET Framework 4.5

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS12-071:Cumulative Security Update for Internet Explorer	High	CIVN-2012-0107 Multiple Vulnerabilities in Microsoft Internet Explorer 9
MS12-072:Vulnerabilities in Windows Shell Could Allow Remote Code Execution	High	CIVN-2012-0108 Remote Code Execution Vulnerability in Microsoft Windows Briefcase
MS12-073:Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Information Disclosure	Low	CIVN-2012-0109 Multiple Vulnerabilities in Microsoft Internet Information Services (IIS)
MS12-074:Vulnerabilities in .NET Framework Could Allow Remote Code Execution	High	CIVN-2012-0110 Remote Code Execution Vulnerabilities in Microsoft .NET Framework
MS12-075:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution	High	CIVN-2012-0111 Multiple Vulnerabilities in Microsoft Windows Kernel-Mode Drivers
MS12-076:Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution	Medium	CIVN-2012-0112 Multiple Vulnerabilities in Microsoft Excel

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin November 2012
http://technet.microsoft.com/en-us/security/bulletin/ms12-Nov

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/ms12-nov

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India