12345

8/28/2012

Microsoft Security Bulletin Summary for July 2012

1. Introduction

Microsoft(MS)'s regular security updates were released for July 2012.
Users who use MS OS strongly recommended update to be safe from Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution, Vulnerability in Microsoft Data Access Components Could Allow Remote Code Execution, Vulnerability in Visual Basic for Applications Could Allow Remote Code Execution, Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege, Vulnerability in Windows Shell Could Allow Remote Code Execution, Vulnerability in TLS Could Allow Information Disclosure, Vulnerabilities in SharePoint Could Allow Elevation of Privilege and Vulnerability in Microsoft Office for Mac Could Allow Elevation of Privilege.



2. Update details

[Critical]
[MS12-043] Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)
Vulnerability: MSXML Uninitialized Memory Corruption Vulnerability - CVE-2012-1889

This security update resolves a publicly disclosed vulnerability in Microsoft XML Core Services. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes the user to the attacker's website.

Affected Softwares

- Windows XP SP3 Microsoft XML Core Services 3.0
- Windows XP SP3 Microsoft XML Core Services 4.0
- Windows XP SP3 Microsoft XML Core Services 6.0
- Windows XP Professional x64 Edition SP2 Microsoft XML Core Services 3.0
- Windows XP Professional x64 Edition SP2 Microsoft XML Core Services 4.0
- Windows XP Professional x64 Edition SP2 Microsoft XML Core Services 6.0
- Windows Server 2003 SP2 Microsoft XML Core Services 3.0
- Windows Server 2003 SP2 Microsoft XML Core Services 4.0
- Windows Server 2003 SP2 Microsoft XML Core Services 6.0
- Windows Server 2003 x64 Edition SP2 Microsoft XML Core Services 3.0
- Windows Server 2003 x64 Edition SP2 Microsoft XML Core Services 4.0
- Windows Server 2003 x64 Edition SP2 Microsoft XML Core Services 6.0
- Windows Server 2003 SP2 Itanium-based Microsoft XML Core Services 3.0
- Windows Server 2003 SP2 Itanium-based Microsoft XML Core Services 4.0
- Windows Server 2003 SP2 Itanium-based Microsoft XML Core Services 6.0
- Windows Vista SP2 Microsoft XML Core Services 3.0
- Windows Vista SP2 Microsoft XML Core Services 4.0
- Windows Vista SP2 Microsoft XML Core Services 6.0
- Windows Vista x64 Edition SP2 Microsoft XML Core Services 3.0
- Windows Vista x64 Edition SP2 Microsoft XML Core Services 4.0
- Windows Vista x64 Edition SP2 Microsoft XML Core Services 6.0
- Windows Server 2008 32bit SP2 Microsoft XML Core Services 3.0
- Windows Server 2008 32bit SP2 Microsoft XML Core Services 4.0
- Windows Server 2008 32bit SP2 Microsoft XML Core Services 6.0
- Windows Server 2008 64bit SP2 Microsoft XML Core Services 3.0
- Windows Server 2008 64bit SP2 Microsoft XML Core Services 4.0
- Windows Server 2008 64bit SP2 Microsoft XML Core Services 6.0
- Windows Server 2008 Itanium-based SP2 Microsoft XML Core Services 3.0
- Windows Server 2008 Itanium-based SP2 Microsoft XML Core Services 4.0
- Windows Server 2008 Itanium-based SP2 Microsoft XML Core Services 6.0
- Windows 7 32bit Microsoft XML Core Services 3.0
- Windows 7 32bit Microsoft XML Core Services 4.0
- Windows 7 32bit Microsoft XML Core Services 6.0
- Windows 7 32bit SP1 Microsoft XML Core Services 3.0
- Windows 7 32bit SP1 Microsoft XML Core Services 4.0
- Windows 7 32bit SP1 Microsoft XML Core Services 6.0
- Windows 7 64bit Itanium-based Microsoft XML Core Services 3.0
- Windows 7 64bit Itanium-based Microsoft XML Core Services 4.0
- Windows 7 64bit Itanium-based Microsoft XML Core Services 6.0
- Windows 7 64bit SP1 Itanium-based Microsoft XML Core Services 3.0
- Windows 7 64bit SP1 Itanium-based Microsoft XML Core Services 4.0
- Windows 7 64bit SP1 Itanium-based Microsoft XML Core Services 6.0
- Windows Server 2008 R2 64bit based Microsoft XML Core Services 3.0
- Windows Server 2008 R2 64bit based Microsoft XML Core Services 6.0
- Windows Server 2008 R2 64bit SP1 based Microsoft XML Core Services 3.0
- Windows Server 2008 R2 64bit SP1 based Microsoft XML Core Services 4.0
- Windows Server 2008 R2 64bit SP1 based Microsoft XML Core Services 6.0
- Windows Server 2008 R2 Itanium-based Microsoft XML Core Services 3.0
- Windows Server 2008 R2 Itanium-based Microsoft XML Core Services 4.0
- Windows Server 2008 R2 Itanium-based Microsoft XML Core Services 6.0
- Windows Server 2008 R2 SP1 Itanium-based Microsoft XML Core Services 3.0
- Windows Server 2008 R2 SP1 Itanium-based Microsoft XML Core Services 4.0
- Windows Server 2008 R2 SP1 Itanium-based Microsoft XML Core Services 6.0

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-043




[Critical]
[MS12-044] Cumulative Security Update for Internet Explorer (2719177)
Vulnerability: Cached Object Remote Code Execution Vulnerability - CVE-2012-1522
Attribute Remove Remote Code Execution Vulnerability - CVE-2012-1524


This security update resolves two privately reported vulnerabilities in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Internet Explorer 9 with Windows Vista SP2
- Internet Explorer 9 with Windows Vista x64 Edition SP2
- Internet Explorer 9 with Windows Server 2008 for 32-bit SP2
- Internet Explorer 9 with Windows Server 2008 for 64-bit based Systems SP2
- Internet Explorer 9 with Windows 7 for 32-bit and Windows 7 for 32-bit SP1
- Internet Explorer 9 with Windows 7 for x64-based and Windows 7 for x64-based SP1
- Internet Explorer 9 with Windows Server 2008 R2 for 64-bit and Windows Server 2008 R2 for 64-bit SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-044



[Critical]
[MS12-045] Vulnerability in Microsoft Data Access Components Could Allow Remote Code Execution (2698365)
Vulnerability: ADO Cachesize Heap Overflow RCE Vulnerability - CVE-2012-1891

This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views a specially crafted webpage. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Windows XP SP3 Microsoft Data Access Components 2.8 SP1
- Windows XP Professional x64 Edition SP2 Microsoft Data Access Components 2.8 SP2
- Windows Server 2003 SP2 Microsoft Data Access Components 2.8 SP2
- Windows Server 2003 x64 Edition SP2 Microsoft Data Access Components 2.8 SP2
- Windows Server 2003 with SP2 for Itanium-based Systems Microsoft Data Access Components 2.8 SP2
- Windows Vista SP2 Windows Data Access Components 6.0
- Windows Vista x64 Edition SP2 Windows Data Access Components 6.0
- Windows Server 2008 for 32-bit Systems SP2 Windows Data Access Components 6.0
- Windows Server 2008 for x64-based SP2 Windows Data Access Components 6.0
- Windows Server 2008 for Itanium-based Systems SP2 Windows Data Access Components 6.0
- Windows 7 for 32-bit Systems Windows Data Access Components 6.0
- Windows 7 for 32-bit Systems SP1 Windows Data Access Components 6.0
- Windows 7 for x64-based Systems Windows Data Access Components 6.0
- Windows 7 for x64-based Systems SP1 Windows Data Access Components 6.0
- Windows Server 2008 R2 for x64-based Systems Windows Data Access Components 6.0
- Windows Server 2008 R2 for x64-based Systems SP1 Windows Data Access Components 6.0
- Windows Server 2008 R2 for Itanium-based Systems Windows Data Access Components 6.0
- Windows Server 2008 R2 for Itanium-based Systems SP1 Windows Data Access Components 6.0

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-045



[Important]
[MS12-046] Vulnerability in Visual Basic for Applications Could Allow Remote Code Execution (2707960)
Vulnerability: Visual Basic for Applications Insecure Library Loading Vulnerability - CVE-2012-1854

This security update resolves one publicly disclosed vulnerability in Microsoft Visual Basic for Applications. The vulnerability could allow remote code execution if a user opens a legitimate Microsoft Office file (such as a .docx file) that is located in the same directory as a specially crafted dynamic link library (DLL) file. An attacker could then install programs; view, change, or delete data; or create new accounts that have full user rights. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Microsoft Office 2003 Service Pack 3
- Microsoft Office 2007 Service Pack 2
- Microsoft Office 2007 Service Pack 3
- Microsoft Office 2010 32-bit
- Microsoft Office 2010 SP1 32-bit
- Microsoft Office 2010 64-bit
- Microsoft Office 2010 SP1 64-bit

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-046



[Important]
[MS12-047] Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2718523)
Vulnerability: Keyboard Layout Vulnerability - CVE-2012-1890
Win32k Incorrect Type Handling Vulnerability - CVE-2012-1893


This security update resolves one publicly disclosed and one privately reported vulnerability in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows Server 2008 for 32bit SP2 *
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2 *
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1 *
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1 *

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-047



[Important]
[MS12-048] Vulnerability in Windows Shell Could Allow Remote Code Execution (2691442)
Vulnerability: Command Injection Vulnerability - CVE-2012-0175

This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a file or directory with a specially crafted name. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows Server 2008 for 32bit SP2 *
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2 *
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1 *
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1 *

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-048



[Important]
[MS12-049] Vulnerability in TLS Could Allow Information Disclosure (2655992)
Vulnerability: TLS Protocol Vulnerability - CVE-2012-1870

This security update resolves a publicly disclosed vulnerability in TLS. The vulnerability could allow information disclosure if an attacker intercepts encrypted web traffic served from an affected system. All cipher suites that do not use CBC mode are not affected.

Affected Softwares

- Windows XP SP3
- Windows XP Professional x64 Edition SP2
- Windows Server 2003 SP2
- Windows Server 2003 x64 Edition SP2
- Windows Server 2003 Itanium-based SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Windows Server 2008 for 32bit and Windows Server 2008 for 32bit SP2 *
- Windows Server 2008 for x64-based and Windows Server 2008 for x64-based SP2 *
- Windows Server 2008 for Itanium-based and Windows Server 2008 for Itanium SP2
- Windows 7 for 32-bit and Windows 7 for 32bit SP1
- Windows 7 for x64-based and Windows 7 for x64-based SP1
- Windows Server 2008 R2 for x64-based and Windows Server R2 for x64-based SP1 *
- Windows Server 2008 R2 for Itanium-based and Windows Server 2008 R2 for Itanium SP1 *

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-049



[Important]
[MS12-050] Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502)
Vulnerability: HTML Sanitization Vulnerability - CVE-2012-1858
XSS scriptresx.ashx Vulnerability - CVE-2012-1859
SharePoint Search Scope Vulnerability - CVE-2012-1860
SharePoint Script in Username Vulnerability - CVE-2012-1861
SharePoint URL Redirection Vulnerability - CVE-2012-1862
SharePoint Reflected List Parameter Vulnerability - CVE-2012-1863


This security update resolves one publicly disclosed and five privately reported vulnerabilities in Microsoft SharePoint and Windows SharePoint Services. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.

Affected Softwares

- Microsoft InfoPath 2007 SP2
- Microsoft InfoPath 2007 SP3
- Microsoft InfoPath 2010 32-bit
- Microsoft InfoPath 2010 SP1 32-bit
- Microsoft InfoPath 2010 64-bit
- Microsoft InfoPath 2010 SP1 64-bit
- Microsoft Office SharePoint Server 2007 SP2 32-bit
- Microsoft Office SharePoint Server 2007 SP3 32-bit
- Microsoft Office SharePoint Server 2007 SP2 64-bit
- Microsoft Office SharePoint Server 2007 SP3 64-bit
- Microsoft SharePoint Server 2010
- Microsoft SharePoint Server 2010 SP1
- Microsoft Groove Server 2010
- Microsoft Groove Server 2010 SP1
- Microsoft Windows SharePoint Services 3.0 SP2 32-bit
- Microsoft Windows SharePoint Services 3.0 SP2 64-bit
- Microsoft SharePoint Foundation 2010
- Microsoft SharePoint Foundation 2010 SP1
- Microsoft Office Web Apps 2010
- Microsoft Office Web Apps 2010 SP1

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-050



[Important]
[MS12-051] Vulnerability in Microsoft Office for Mac Could Allow Elevation of Privilege (2721015)
Vulnerability: Office for Mac Improper Folder Permissions Vulnerability - CVE-2012-1894

This security update resolves one publicly disclosed vulnerability in Microsoft Office for Mac. The vulnerability could allow elevation of privilege if a malicious executable is placed on an affected system by an attacker, and then another user logs on later and runs the malicious executable. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

Affected Softwares

- Microsoft Office for Mac 2011

- Reference site

http://technet.microsoft.com/en-us/security/bulletin/MS12-051

No comments:

Post a Comment