Advisories

CERT-In Advisory CIAD-2013-0089

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 11, 2013

Systems Affected

Windows XP SP3 and Professional x64 Edition SP2
Windows Server 2003 SP2(32bit, 64 bit & Itanium-based Systems)
Windows Vista SP2(32 & 64 bit)
Windows Server 2008 for 32-bit Systems SP2, x64-based Systems SP2 and Itanium-based Systems SP2
Windows Server 2008 R2 for x64-based Systems SP1, Itanium-based Systems and Itanium-based Systems SP 1
Windows 8 & 8.1 for 32-bit Systems and x64-bit Systems
Windows 7 32-bit, x64-based Systems SP1
Windows Server 2008 SP2 (32 & 64 bit server core installation)
Windows Server 2008 R2 SP1 x64 bit (server core installation)
Windows Server 2012 and Windows Server 2012 R2 (Server Core installation)
Windows RT
Windows RT 8.1
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2010 SP1 and SP2
Microsoft Office Web Apps 2013
ASP.NET SignalR 1.1.x. & 2.0.x
Microsoft Visual Studio Team Foundation Server 2013
Microsoft Exchange Server 2010 SP2 & SP3
Microsoft Exchange Server 2007 SP3
Microsoft Exchange Server 2013 Cumulative Update 2 & 3
Microsoft Office 2007 SP3
Microsoft Office 2010 SP1 & SP2 (32-bit and 64-bit editions)

Component Affected

Internet Explorer 6, 7, 8, 9, 10 and 11
Windows Script 5.6, 5.7 and 5.8
Microsoft Office 2013 (32-bit & 64-bit editions)
Microsoft Office 2013 RT
Oracle Outside In Technology versions 8.4.0 and 8.4.1

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS13-096:Vulnerability in Microsoft Graphics Component Could allow Remote Code Execution	High	CIVN-2013-0195 Microsoft� Graphics Component Remote Code Execution Vulnerability
MS13-097:Cumulative Security Update for Internet Explorer	High	CIVN-2013-0212 Multiple Vulnerabilities in Microsoft Internet Explorer
MS013-098:Vulnerability in Windows Could Allow Remote Code Execution	High	CIVN-2013-0213 WinVerifyTrust Signature Verification Bypass Remote Code Execution Vulnerability
MS13-099:Vulnerability in Microsoft Scripting Runtime Object Library Could Allow Remote Code Execution	High	CIVN-2013-0214 Use-After-Free Vulnerability in Microsoft Scripting Runtime Object Library
MS13-100:Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution	Medium	CIVN-2013-0215 Multiple Remote Code Execution Vulnerabilities in Microsoft SharePoint Server
MS13-101:Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege	Medium	CIVN-2013-0216 Multiple Vulnerabilities in Microsoft Windows Kernel-Mode Drivers
MS13-102:Vulnerability in LRPC Client Could Allow Elevation of Privilege	Medium	CIVN-2013-0217 Microsoft Local Remote Procedure Call Privilege Elevation Vulnerability
MS13-103:Vulnerability in ASP.NET SignalR Could Allow Elevation of Privilege	High	CIVN-2013-0218 Microsoft ASP.NET SignalR Cross Site Scripting Vulnerability
MS13-104:Vulnerability in Microsoft Office Could Allow Information Disclosure	Medium	CIVN-2013-0219 Microsoft Office Information Disclosure Vulnerability
MS13-105:Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution	High	CIVN-2013-0220 Multiple Vulnerabilities in Microsoft Exchange Server
MS13-106:Vulnerability in a Microsoft Office Shared Component Could Allow Security Feature Bypass	Medium	CIVN-2013-0221 Microsoft Office Security Bypass Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December, 2013
http://technet.microsoft.com/en-us/security/bulletin/ms13-dec

Vendor Information

Microsoft Corporation
http://technet.microsoft.com/en-us/security/bulletin/ms13-dec

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India