Advisories

CERT-In Advisory CIAD-2013-0082

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: November 13, 2013

Systems Affected

Windows XP SP 3 and Professional x64 Edition SP 2
Microsoft Office 2003 SP 3
Microsoft Office 2007 SP 3
Windows 7 for 32-bit Systems and x64-based Systems Service Pack 1
Microsoft Office 2010 SP 1 & 2 (32-bit editions & 64-bit editions)
Windows Server 2003 SP 2, x64 Edition SP 2 and SP2 for Itanium-based Systems
Microsoft Office 2013 RT
Windows Server 2003 x64 Edition & Itanium-based Systems Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 SP2 for 32-bit Systems, x64-based Systems and Itanium-based Systems (Server Core installation)
Windows Server 2008 R2 for x64-based & Itanium-based Systems Service Pack 1(Server Core installation)
Windows RT
Windows RT 8.1
Windows 8 & 8.1 for 32-bit Systems
Windows 8 for x64-based Systems (Pro and Enterprise editions only)
Windows Server 2012 (Standard and Datacenter editions, and Hyper-V Server 2012 only)
Windows Server 2012 R2(Server Core installation)

Component Affected

Microsoft Office 2007 SP 3
Microsoft Office 2010 SP 1 & 2 (32-bit editions & 64-bit editions)
Microsoft Office 2013 (32-bit editions & 64-bit editions)
Microsoft Office 2013 RT
Internet Explorer 6,7,8,9,10, 11

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS13-088:Cumulative Security Update for Internet Explorer	High	CIVN-2013-0197 Multiple Vulnerabilities in Microsoft Internet Explorer
MS13-089:Vulnerability in Windows Graphics Device Interface Could Allow Remote Code Execution	High	CIVN-2013-0198 Microsoft Graphics Component Remote Code Execution Vulnerability
MS13-090:Cumulative Security Update of ActiveX Kill Bits	High	CIVN-2013-0199 Microsoft Windows InformationCardSigninHelper Class ActiveX Control Code Execution Vulnerability
MS13-091:Vulnerabilities in Microsoft Office Could Allow Remote Code Execution	High	CIVN-2013-0200 Multiple Remote Code Execution Vulnerabilities in Microsoft Office
MS13-092:Vulnerability in Hyper-V Could Allow Elevation of Privilege	Medium	CIVN-2013-0201 Privilege Elevation Vulnerability in Microsoft Windows Hyper-V
MS13-093:Vulnerability in Windows Ancillary Function Driver Could Allow Information Disclosure	Medium	CIVN-2013-0202 Information Disclosure Vulnerability in Windows Ancillary Function Driver
MS13-094:Vulnerability in Microsoft Outlook Could Allow Information Disclosure	High	CIVN-2013-0203 Information Disclosure Vulnerability in Microsoft Outlook
MS13-095:Vulnerability in Digital Signatures Could Allow Denial of Service	High	CIVN-2013-0204 Microsoft Windows X.509 Certificate Processing Denial of Service Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin November 2013
http://technet.microsoft.com/en-us/security/bulletin/ms13-nov

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/ms13-nov

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India