Advisories

CERT-In Advisory CIAD-2012-0054

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 12, 2012

Systems Affected

Windows Vista SP2
Windows Vista x64 Edition SP2
Windows 8 for 32-bit & 64-bit System
Windows 7 for 32-bit Systems SP1 and prior
Windows 7 for x64-based Systems SP1 and prior
Windows RT
Windows XP SP3
Windows XP Professional x64 Edition SP2
Microsoft Exchange Server 2007 SP
Microsoft Exchange Server 2010 SP1,2
Windows Server 2003 Itanium SP2
Windows Server 2003 SP2
Windows Server 2003 x64 Edition SP2, 3
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Server 2008 for 32-bit Systems SP2
Windows Server 2008 for x64-based Systems SP1, 2
Windows Server 2008 for Itanium-based Systems SP2
Windows Server 2008 R2 for x64-based Systems SP1 and prior
Windows Server 2008 R2 for Itanium-based Systems SP1 and prior \
Windows Server 2012

Component Affected

Internet Explorer 9,10
Microsoft Word 2003 SP3
Microsoft Word 2007 SP2,3
Microsoft Word 2010 SP1 (32-bit,64-bit editions)
Word Automation Services
Microsoft Word Viewer
Microsoft Office Compatibility Pack SP2,3
Microsoft SharePoint Server 2010 SP1
Microsoft Office Web Apps 2010 SP1
DirectX 9.0 through 11.1

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS12-077:Cumulative Security Update for Internet Explorer	High	CIVN-2012-0113 Remote Code Execution Vulnerabilities in Internet Explorer
MS12-078:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution	High	CIVN-2012-0114 Remote Code Execution Vulnerabilities in Windows Kernel-Mode Drivers
MS12-079:Vulnerability in Microsoft Word Could Allow Remote Code Execution	High	CIVN-2012-0115 Remote Code Execution Vulnerability in Microsoft Word
MS12-080:Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution	High	CIVN-2012-0116 Mutiple vulnerabilities in Microsoft Exchange Server
MS12-081:Vulnerability in Windows File Handling Component Could Allow Remote Code Execution	High	CIVN-2012-0117 Remote Code� Execution on Vulnerability in Windows File Handling Component
MS12-082:Vulnerability in DirectPlay Could Allow Remote Code Execution	High	CIVN-2012-0118 Remote Code Execution Vulnerability in Microsoft Windows DirectPlay
MS12-083:Vulnerability in IP-HTTPS Component Could Allow Security Feature Bypass	Medium	CIVN-2012-0119 Microsoft Windows Revoke Certificate Bypass Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December 2012
http://technet.microsoft.com/en-us/security/bulletin/ms12-dec

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/ms12-dec

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India