Gravité: : Élevé
  Date du conseil: 09 octobre 2012

  Description

Microsoft addresses the following vulnerabilities in its October batch of patches:


  • (MS12-064) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2742319)
    Risk Rating: Critical

    This security update addresses vulnerabilities affecting Microsoft Office. When successfully exploited, it could allow remote code execution via a specially crafted .RTF file. Read more here.


  • (MS12-065) Vulnerability in Microsoft Works Could Allow Remote Code Execution (2754670)
    Risk Rating: Important

    This patch addresses a vulnerability affecting Microsoft Works that exists in Microsoft Works 9. Read more here.


  • (MS12-066) Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege (2741517)
    Risk Rating: Important

    This patch addresses a vulnerability affecting Microsoft Office, Microsoft Communications Platforms, Microsoft Server software, and Microsoft Office Web Apps. Read more here.


  • (MS12-067) Vulnerabilities in FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution (2742321)
    Risk Rating: Important

    This patch addresses vulnerabilities existing in Microsoft FAST Search Server 2010 for SharePoint. When exploited, it could allow remote code execution in the security context (user accounts) with a token. Read more here.


  • (MS12-068) Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2724197)
    Risk Rating: Important

    This patch addresses a vulnerability existing in all supported releases of Microsoft Windows with the exception of Windows 8 and Windows Server 2012. Read more here.


  • (MS12-069) Vulnerability in Kerberos Could Allow Denial of Service (2743555)
    Risk Rating: Important

    This patch addresses a vulnerability existing in Microsoft Windows. It could allow denial of service attacks when a remote attacker sends a specially crafted request to the Kerberos server. Read more here.


  • (MS12-070) Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849)
    Risk Rating: Important

    This patch addresses a vulnerability existing in Microsoft SQL Server on systems with SQL Server Reporting Services (SSRS). It is a cross-site scripting vulnerability that could allow attackers to execute arbitrary commands on the SSRS site. Read more here.


  Information Exposure Rating:

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date IDF Compatibility
MS12-064 CVE-2012-2528 1005214 Microsoft RTF File listid Use-After-Free Vulnerability 09-Oct-12 YES

CVE-2012-0182 1005223 Microsoft Word PAPX Section Corruption Vulnerability (CVE-2012-0182) 24-Oct-12 YES
MS12-065 CVE-2012-2550 1005215 Microsoft Works Heap Vulnerability 09-Oct-12 YES
MS13-066 CVE-2012-2520 1000522 Generic Cross Site Scripting(XSS) Prevention 18-July-07 NO
MS13-069 CVE-2012-2551 1000552 Generic Cross Site Scripting(XSS) Prevention 18-July-07 NO