12345

7/15/2012

Microsoft Security Bulletin Summary for June 2012

1. Introduction 

Microsoft(MS)'s regular security updates were released for June 2012.
Users who use MS OS strongly recommended update to be safe from Vulnerabilities in .NET Framework Could Allow Remote Code Execution, Vulnerability in .NET Framework Could Allow Remote Code Execution, Vulnerabilities in Lync Could Allow Remote Code Execution, Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege, Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege and Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege.



2. Update details

[Critical]
[MS12-036] Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2693777)
Vulnerability: Remote Desktop Protocol Vulnerability - CVE-2012-0173

This security update resolves two privately reported vulnerabilities in the .NET Framework. The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows 2008 for 32bit SP2
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-036



[Critical]
[MS12-037] Cumulative Security Update for Internet Explorer (2699988)

Vulnerability: Center Element Remote Code Execution Vulnerability - CVE-2012-1523
HTML Sanitization Vulnerability - CVE-2012-1858
EUC-JP Character Encoding Vulnerability - CVE-2012-1872
Null Byte Information Disclosure Vulnerability - CVE-2012-1873
Developer Toolbar Remote Code Execution Vulnerability - CVE-2012-1874
Same ID Property Remote Code Execution Vulnerability - CVE-2012-1875
Col Element Remote Code Execution Vulnerability - CVE-2012-1876
Title Element Change Remote Code Execution Vulnerability - CVE-2012-1877
OnBeforeDeactivate Event Remote Code Execution Vulnerability - CVE-2012-1878
insertAdjacentText Remote Code Execution Vulnerability - CVE-2012-1879
insertRow Remote Code Execution Vulnerability - CVE-2012-1880
OnRowsInserted Event Remote Code Execution Vulnerability - CVE-2012-1881
Scrolling Events Information Disclosure Vulnerability - CVE-2012-1882

This security update resolves one publicly disclosed and twelve privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Internet Explorer 6 with Windows XP Service Pack 3
- Internet Explorer 6 with Windows XP Professional x64 Edition SP2
- Internet Explorer 6 with Windows Server 2003 SP2
- Internet Explorer 6 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 6 with Windows Server 2003 with SP2 for Itanium-based Systems
- Internet Explorer 7 with Windows XP SP3
- Internet Explorer 7 with Windows XP Professional x64 Edition SP2
- Internet Explorer 7 with Windows Server 2003 SP2
- Internet Explorer 7 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 7 with Windows Server 2003 with SP2 for Itanium-based Systems
- Internet Explorer 7 whit Windows Vista SP2
- Internet Explorer 7 with Windows Vista x64 Edition SP2
- Internet Explorer 7 with Windows Server 2008 for 32-bit Systems SP2
- Internet Explorer 7 with Windows Server 2008 for x64-based Systems SP2
- Internet Explorer 7 with Windows Server 2008 for Itanium-based Systems SP2
- Internet Explorer 8 with Windows XP SP3
- Internet Explorer 8 with Windows XP Professional x64 Edition SP2
- Internet Explorer 8 with Windows Server 2003 SP2
- Internet Explorer 8 with Windows Server 2003 x64 Edition SP2
- Internet Explorer 8 with Windows 7 for 32-bit and Windows 7 for 32-bit SP1
- Internet Explorer 8 with Windows 7 for x64-based and Windows 7 for x64-based SP1
- Internet Explorer 8 whit Windows Vista SP2
- Internet Explorer 8 with Windows Vista x64 Edition SP2
- Internet Explorer 8 with Windows Server 2008 for 32-bit Systems SP2
- Internet Explorer 8 with Windows Server 2008 for 64-bit Systems SP2
- Internet Explorer 8 with Windows 2008 R2 for x64-based Systems SP1
- Internet Explorer 8 with Windows 2008 R2 for Itanium-based Systems SP1
- Internet Explorer 9 with Windows Vista SP2
- Internet Explorer 9 with Windows Vista x64 Edition SP2
- Internet Explorer 9 with Windows Server 2008 for 32-bit SP2
- Internet Explorer 9 with Windows Server 2008 for 64-bit Itanium-based Systems SP2
- Internet Explorer 9 with Windows 7 for 32-bit and Windows 7 for 32-bit SP1
- Internet Explorer 9 with Windows 7 for x64-based and Windows 7 for x64-based SP1
- Internet Explorer 9 with Windows Server 2008 R2 for 64-bit and Windows Server 2008 R2 for 64-bit SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-037



[Critical]
[MS12-038] Vulnerability in .NET Framework Could Allow Remote Code Execution (2706726)
Vulnerability: .NET Framework Memory Access Vulnerability - CVE-2012-1855

This security update resolves one privately reported vulnerability in the Microsoft .NET Framework. The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerability could also be used by Windows .NET Framework applications to bypass Code Access Security (CAS) restrictions. In a web browsing attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Affected Softwares

- Windows XP SP3 for Microsoft .NET Framework 2.0 SP2
- Windows XP SP3 for Microsoft .NET Framework 4
- Windows XP Professional x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows XP Professional x64 Edition SP2 for Microsoft .NET Framework 4
- Windows Server 2003 SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 SP2 for Microsoft .NET Framework 4
- Windows Server 2003 x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 x64 Edition SP2 for Microsoft .NET Framework 4
- Windows Server 2003 SP2 Itanium-based for Microsoft .NET Framework 2.0 SP2
- Windows Server 2003 SP2 Itanium-based for Microsoft .NET Framework 4
- Windows Vista SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Vista SP2 for Microsoft .NET Framework 4
- Windows Vista x64 Edition SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Vista x64 Edition SP2 for Microsoft .NET Framework 4
- Windows 2008 for 32bit SP2 for Microsoft .NET Framework 2.0 SP2
- Windows 2008 for 32bit SP2 for Microsoft .NET Framework 4
- Windows Server 2008 for x64-based SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2008 for x64-based SP2 for Microsoft .NET Framework 4
- Windows Server 2008 for Itanium SP2 for Microsoft .NET Framework 2.0 SP2
- Windows Server 2008 for Itanium SP2 for Microsoft .NET Framework 4
- Windows 7 for 32-bit for Microsoft .NET Framework 3.5.1
- Windows 7 for 32-bit for Microsoft .NET Framework 4
- Windows 7 for 32bit SP1 for Microsoft .NET Framework 3.5.1
- Windows 7 for 32bit SP1 for Microsoft .NET Framework 4
- Windows 7 for x64-based for Microsoft .NET Framework 3.5.1
- Windows 7 for x64-based SP1 for Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based for Microsoft .NET Framework 3.5.1*
- Windows Server 2008 R2 for x64-based for Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based SP1 for Microsoft .NET Framework 3.5.1*
- Windows Server 2008 R2 for x64-based SP1 for Microsoft .NET Framework 4 *
- Windows Server 2008 R2 for Itanium-based for Microsoft .NET Framework 3.5.1
- Windows Server 2008 R2 for Itanium-based for Microsoft .NET Framework 4
- Windows Server 2008 R2 for Itanium SP1 for Microsoft .NET Framework 3.5.1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-038



[Important]
[MS12-039] Vulnerabilities in Lync Could Allow Remote Code Execution (2707956)

Vulnerability: TrueType Font Parsing Vulnerability - CVE-2011-3402
TrueType Font Parsing Vulnerability - CVE-2012-0159
Lync Insecure Library Loading Vulnerability - CVE-2012-1849
HTML Sanitization Vulnerability - CVE-2012-1858

This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft Lync. The most severe vulnerabilities could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts.

Affected Softwares

- Microsoft Communicator 2007 R2
- Microsoft Lync 2010 (32-bit)
- Microsoft Lync 2010 (64-bit)
- Microsoft Lync 2010 Attendee
- Microsoft Lync 2010 Attendee
- Microsoft Lync 2010 Attendant (32-bit)
- Microsoft Lync 2010 Attendant (64-bit)

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-039



[Important]
[MS12-040] Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege (2709100)
Vulnerability: Dynamics AX Enterprise Portal XSS Vulnerability - CVE-2012-1857

This security update resolves one privately reported vulnerability in Microsoft Dynamics AX Enterprise Portal. The vulnerability could allow elevation of privilege if a user clicks a specially crafted URL or visits a specially crafted website. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message that contains the specially crafted URL to the user of the targeted Microsoft Dynamics AX Enterprise Portal site and by convincing the user to click the specially crafted URL. Internet Explorer 8 and Internet Explorer 9 users browsing to a Microsoft Dynamics AX Enterprise Portal site in the Internet Zone are at a reduced risk. By default, the XSS Filter in Internet Explorer 8 and Internet Explorer 9 prevents this attack in the Internet Zone. However, the XSS Filter in Internet Explorer 8 and Internet Explorer 9 is not enabled by default in the Intranet Zone.

Affected Softwares

- Microsoft Dynamics AX 2012

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-040



[Important]
[MS12-041] Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2709162)

Vulnerability: String Atom Class Name Handling Vulnerability - CVE-2012-1864
String Atom Class Name Handling Vulnerability - CVE-2012-1865
Clipboard Format Atom Name Handling Vulnerability - CVE-2012-1866
Font Resource Refcount Integer Overflow Vulnerability - CVE-2012-1867
Win32k.sys Race Condition Vulnerability - CVE-2012-1868

This security update resolves five privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit any of these vulnerabilities.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows 2008 for 32bit SP2
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-041



[Important]
[MS12-042] Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)

Vulnerability: User Mode Scheduler Memory Corruption Vulnerability - CVE-2012-0217
BIOS ROM Corruption Vulnerability - CVE-2012-1515

This security update resolves one privately reported vulnerability and one publicly disclosed vulnerability in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that exploits the vulnerability. An attacker must have valid logon credentials and be able to log
on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

Affected Softwares

- Windows XP SP3
- Windows Server 2003 SP2
- Windows 7 for x64-based and Windows 7 for x64-based SP1 *
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1 *

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-042

27 comments:

  1. Keyloggers became a massive part of our everyday life. Let’s start with the installation process of the monitoring software. While most keyloggers offer ordinary type of installation, remote keylogger reducec your chances of being caught.

    ReplyDelete
  2. This is the way we have been needing here.

    ReplyDelete
  3. All Assignment Help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expert’s consultation is also available for students. If they have any query they can contact with our experts anytime.
    Law assignment help
    Programming Assignment help

    ReplyDelete
  4. Get research paper outline help services by the best qualified and experienced assignment experts of Students Assignment Help. Our professional and high educated tutors are fluent in writing assignment as they are degree holder from top colleges and universities around the world.

    ReplyDelete
  5. Thanks for sharing this great post! I am sid andrew, working with online assignment help provider company in Australia and help students to complete their best quality assignment before seadline.

    ReplyDelete
  6. Get university assignment help service by top university assignment writers at My Assignment Help OZ. For more information visit us now!

    ReplyDelete
  7. This post is a pool of information. The readers are quite impressed after reading this impressive post. This impressive post certainly encourages to choose Assignment Help Services. You can email us at cs@Myassignmenthelpau.Com or Phone Number: +61-2-8005-8227

    ReplyDelete
  8. Really Appreciate, This impressive post certainly encourages to choose Assignment help Services. Get Assignment help services by the best qualified and experienced assignment experts of Complete My Assignment.

    ReplyDelete
  9. A lot of valuable information can be derived from the post. Certainly, this compelling post will encourage readers to choose Assignment Help Australia services. You can email us at info@firstassignmenthelp.com.

    ReplyDelete
  10. we have created our pricing plan carefully to suit everyone's budget. We have kept our prices to a minimum so that you can enjoy affordable assignment help service from the best assignment helpers providing Assignment help Singapore, New Zealand, Canada, the US and many other places.

    ReplyDelete
  11. شركة فحص تسربات المياه بالرياض http://tiny.cc/4tci5y إحدى المشاكل التي تتعرض لها المنازل وقد لا يشعرُ بها صاحب البيت إلا بعد تفاقمها هي مشكلة تسربات المياه وشركة الطارق للخدمات المنزلية هي أفضل شركة كشف تسربات المياه بالرياض لما تقدمه لعملائها من خدماتٍ كثيرةٍ في هذا المجال تهدف إلى إنهاء مشكلة تسربات المياه بصورةٍ جذريةٍ وبشكلٍ علمي متطورٍ يحافظ على سلامة البناء داخليًا وخارجيًا

    المصدر: شركة فحص تسربات المياه بالرياض

    افضل شركة تسليك مجاري بالرياض http://tiny.cc/2cph5y الشركة متخصصة في تنظيف وتسليك المجاري وحل كل مشاكلها وإزالة الروائح الكريهة وتخليصك منها ,فلدى الشركة خبرة طويلة عبر السنين الماضية في هذا النوع من الأعمال كمان أنها مسئولة عن التنظيف و التسليك بما تمتلكه من أدوات ومعدات حديثة تنظف وتسلك وتحل المشكلة التي تسبب انسداد المجرى مما تسبب التعطيل وانبعاث الروائح الكريهة ,
    لدى الشركة خبرة في تسليك كل ما يتعلق بالصرف الصحي
    لا تقلق بانسداد المجاري أو طفحها مجددا نحن نضمن لك أعلى مستوى من الخدمة . .… اقرأ المزيد

    المصدر: شركة تسليك مجاري بالرياض

    ReplyDelete
  12. By ordering a Cheap Dissertation Writing Services from our Nursing Writing Services,be completely sure your personal information obtained is protected and will never be revealed to any third party.

    ReplyDelete
  13. Very informative and well-written post! The quite interesting and nice topic chosen for the post. LiveWebTutors is here to offer excellent Assignment Help writing services to UK students as well as all over the world. Students who struggle to craft great assignments get in touch with us. They may receive the very best assistance from our side. Livewebtutors provide the best assignment help UK service online for students to score A+ Grades. You can email us at cs@livewebtutors.com or Phone Number: +44-20-8144-9988.

    ReplyDelete
  14. Economics Assignment Help

    We at Fullassignment.com bring to you the most significant Economics assignment writing service at the best cost. With long stretches of understanding we are prepared to give online assignment help over the globe.You will be guided here with a portion of the information of Economics assignment which could assist you in deciding writing a Economics assignment. Nonetheless we uneuqivocally prescribe you to benefit Economics assignment help from our specialist to find out about marketing and its scope.

    https://fullassignment.com/

    ReplyDelete

  15. نقل عفش من الرياض الى مصر نقل عفش من الرياض الى مصر
    نقل عفش بالدمام نقل عفش بالدمام
    نقل عفش بالاحساء نقل عفش بالاحساء
    نقل عفش داخل مكة نقل عفش داخل مكة


    ReplyDelete
  16. Download Microsoft office as it could be the best choice for your work if you want to manage your data with an efficient tool.

    ReplyDelete
  17. After installing the setup.office.com on your computer system, your existing MS account or create a new account and enter the product key.

    ReplyDelete
  18. Very nicely explained and include all important information.I also recommend visiting elearning mobile app developer

    ReplyDelete
  19. Tekniko Global is a Top mobile app development company in Noida, Delhi. We have core expert for IOS app & Android application development. We provide Custom Mobile App development services at reasonable cost.
    mobile app development company in delhi

    ReplyDelete
  20. Select the option of Assignment Help when you don’t want to take the stress of writing your assignments or homework. This option allows you to get experts’ assistance for composing your academic papers even in adverse conditions. You can take the online help of academic writers at any time using these kinds of services. If you can’t pay attention to homework writing or don’t have enough time, this option will help you a lot. Handle everything for composing your papers even in adverse conditions via online academic writing services.
    Assignment Helper | Assignments Help | Help with assignment

    ReplyDelete
  21. I loved this assignment article and kept updating interesting articles. Thanks a lot for sharing this blog post. hire assignment writer

    ReplyDelete