Microsoft Security Bulletin Summary for August 2012

Number: AV12-035
Date: 17 August 2012

Purpose

The purpose of this advisory is to bring attention to the monthly Microsoft Security Bulletin Summary for August. The summary covers 9 bulletins (5 Critical, 4 Important), which address 15 vulnerabilities in some Microsoft products.

Assessment

Microsoft has released the following security bulletins:

MS12-052 - Cumulative Security Update for Internet Explorer (2722913)
Details:            This security update resolves four privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
The security update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Critical
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Temporary
Affected Products:     Internet Explorer 6,7,8 and 9 on their associated operating systems.
CVE References:        CVE-2012-1526, CVE-2012-2521, CVE-2012-2522, and CVE-2012-2523
http://technet.microsoft.com/en-us/security/bulletin/ms12-052

MS12-053 - Vulnerability in Remote Desktop Could Allow Remote Code Execution (2723135)
Details:            This security update resolves a privately reported vulnerability in the Remote Desktop Protocol. The vulnerability could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system.
This security update is rated Critical for all supported editions of Windows XP.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Critical
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Temporary
Affected Products:     Windows XP Service Pack 3
CVE References:        CVE-2012-2526
http://technet.microsoft.com/en-us/security/bulletin/ms12-053
 
MS12-054 - Vulnerabilities in Windows Networking Components Could Allow Remote Code Execution (2733594)
Details:            This security update resolves four privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow remote code execution if an attacker sends a specially crafted response to a Windows print spooler request. This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; Important for all supported editions of Windows Vista; and Moderate for all supported editions of Windows Server 2008, Windows 7, and Windows 2008 R2.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Critical
Maximum Exploitability Index:          3 - Exploit code unlikely
Maximum Denial of Service Exploitability Index:     Permanent
Affected Products:     Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2 and Server Core installation option
CVE References:        CVE-2012-1850, CVE-2012-1851, CVE-2012-1852, and CVE-2012-1853
http://technet.microsoft.com/en-us/security/bulletin/ms12-054

MS12-055 - Vulnerability in Windows Kernel Mode Drivers Could Allow Elevation of Privilege (2731847)
This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application.
This security update is rated Important for all supported releases of Microsoft Windows.
Maximum Security Impact:    Elevation of Privilege
Aggregate Severity Rating:    Important
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Permanent
Affected Products:     Microsoft Windows and Server Core installation option
CVE-2012-2527
http://technet.microsoft.com/en-us/security/bulletin/ms12-055

MS12-056 - Vulnerability in JScript and VBScript Engines Could Allow Remote Code Execution (2706045)
Details:            This security update resolves a privately reported vulnerability in the JScript and VBScript scripting engines on 64-bit versions of Microsoft Windows. The vulnerability could allow remote code execution if a user visited a specially crafted website. This security update is rated Important for JScript 5.8 and VBScript 5.8 on 64-bit Windows clients. This security update is also rated Low for JScript 5.8 and VBScript 5.8 on 64-bit Windows servers.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Important
Maximum Exploitability Index:          3 - Exploit code unlikely
Maximum Denial of Service Exploitability Index:     Temporary
Affected Products:     Microsoft Windows and Windows Server
CVE References:        CVE-2012-2523
http://technet.microsoft.com/en-us/security/bulletin/ms12-056

MS12-057 - Vulnerability in Microsoft Office Could Allow Remote Code Execution (2731879)
Details:            This security update resolves one privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted file or embeds a specially crafted Computer Graphics Metafile (CGM) graphics file into an Office file.
This security update is rated Important for all supported editions of Microsoft Office 2007 and Microsoft Office 2010.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Important
Maximum Exploitability Index:          3 - Exploit code unlikely
Maximum Denial of Service Exploitability Index:     Not applicable
Affected Products:     Office Suite and Other Software
CVE References:        CVE-2012-2524
http://technet.microsoft.com/en-us/security/bulletin/ms12-057

MS12-058 - Vulnerabilities in Microsoft Exchange Server WebReady Document Viewing Could Allow Remote Code Execution (2740358)
This security update resolves publicly disclosed vulnerabilities in Microsoft Exchange Server WebReady Document Viewing. The vulnerabilities could allow remote code execution in the security context of the transcoding service on the Exchange server if a user previews a specially crafted file using Outlook Web App (OWA). This security update is rated Critical for all supported editions of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Critical
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Not applicable
Affected Products:     Microsoft Exchange Server 2007, and 2010.
CVE-2012-1766, CVE-2012-1767,CVE-2012-1768, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771 , CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, CVE-2012-3109, and CVE-2012-3110.
http://technet.microsoft.com/en-us/security/bulletin/ms12-058

MS12-059 - Vulnerability in Microsoft Visio Could Allow Remote Code Execution (2733918)
Details:            This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. This security update is rated Important for all supported editions of Microsoft Visio 2010 and Microsoft Visio Viewer 2010.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Important
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Not applicable
Affected Products:     Microsoft Visio 2010 and Microsoft Visio View 2010
CVE References:        CVE-2012-1888
http://technet.microsoft.com/en-us/security/bulletin/ms12-059

MS12-060 - Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2720573)
Details:            This security update resolves a privately reported vulnerability in Windows common controls. The vulnerability could allow remote code execution if a user visits a website containing specially crafted content designed to exploit the vulnerability. This security update is rated Critical for all supported Microsoft software that included the Windows common controls in their default installations. This includes all supported editions of Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010 (except x64-based editions), Microsoft SQL Server 2000 Analysis Services, Microsoft SQL Server 2000 (except Itanium-based editions), Microsoft SQL Server 2005 (except Microsoft SQL Server 2005 Express Edition, but including Microsoft SQL Server 2005 Express Edition with Advanced Services), Microsoft SQL Server 2008, Microsoft SQL Server 2008 R2, Microsoft Commerce Server 2002, Microsoft Commerce Server 2007, Microsoft Commerce Server 2009, Microsoft Commerce Server 2009 R2, Microsoft Host Integration Server 2004 Service Pack 1, Microsoft Visual FoxPro 8.0, Microsoft Visual FoxPro 9.0, and Visual Basic 6.0 Runtime.
Maximum Security Impact:    Remote Code Execution
Aggregate Severity Rating:    Critical
Maximum Exploitability Index:          1 - Exploit code likely
Maximum Denial of Service Exploitability Index:     Temporary
Affected Products:     Microsoft Office Suites and Components, Microsoft SQL Server Software, Microsoft SQL Server Components
CVE References:        CVE-2012-1856
http://technet.microsoft.com/en-us/security/bulletin/ms12-060

Suggested action

CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.

Microsoft has published a risk matrix table to assist organizations in evaluating and prioritizing deployment of these security updates. This table is available at the following URL:
http://blogs.technet.com/b/msrc/archive/2012/08/14/august-2012-security-updates.aspx

References:
http://technet.microsoft.com/en-us/security/bulletin/ms12-aug

Note to Readers

The Canadian Cyber Incident Response Centre (CCIRC) operates within Public Safety Canada, and works with partners inside and outside Canada to mitigate cyber threats to vital networks outside the federal government. These include systems that keep Canada's critical infrastructure functioning properly, such as the electrical grid and financial networks, or contain valuable commercial information that underpins our economic prosperity. CCIRC supports the owners and operators of systems of national importance, including critical infrastructure, and is responsible for coordinating the national response to any serious cyber security incident.

For general information, please contact Public Safety Canada's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@ps-sp.gc.ca