Gravité: : Critique
  Date du conseil: 14 août 2012

  Description

Microsoft addresses the following vulnerabilities in its August batch of patches:



  • (MS12-052) Cumulative Security Update for Internet Explorer (2722913)
    Risk Rating: Critical

    This bulletin patches four identified vulnerabilities that exist in version 6-9 of the Internet Explorer browser. Attackers looking to exploit these vulnerabilities lures users to open or view a specially crated webpage. Read more here.


  • (MS12-053) Vulnerability in Remote Desktop Could Allow Remote Code Execution (2723135)
    Risk Rating: Critical

    Microsoft issues a patch that resolves a vulnerability found in the Remote Desktop Protocol (RDP) in Windows XP SP3 systems. The vulnerability exists in the way deleted objects are accessed by RDP. Read more here.


  • (MS12-054) Vulnerabilities in Windows Networking Components Could Allow Remote Code Execution (2733594)
    Risk Rating: Critical

    This bulletin resolves four vulnerabilities that exist in the Windows networking components and print spooler. Exploitation of these vulnerabilities involves an attacker sending a specially crated response to a Windows print/networking request. Read more here.


  • (MS12-055) Vulnerability in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2731847)
    Risk Rating: Important

    This patch resolves an elevation of privilege vulnerability found in the handling of objects in memory done by the Windows kernel-mode driver. Read more here.


  • (MS12-056) Vulnerability in JScript and VBScript Engines Could Allow Remote Code Execution (2706045)
    Risk Rating: Important

    This bulletin resolves a remote code execution vulnerability found in the scripting engines JScript and VBScript in Windows 64-bit systems. Read more here.


  • (MS12-057) Vulnerability in Microsoft Office Could Allow Remote Code Execution (2731879)
    Risk Rating: Important

    Microsoft issues a patch that resolves a remote code execution vulnerability existing in several versions of MS Office. Read more here.


  • (MS12-058) Vulnerabilities in Microsoft Exchange Server WebReady Document Viewing Could Allow Remote Code Execution (2740358)
    Risk Rating: Critical

    This patch resolves several vulnerabilities that are present in the Microsoft Exchange Server WebReady Document View feature. Attackers who are looking to exploit this vulnerability may send a specially crafted file that can be viewed by a user using the Outlook Web Access in a browser. Read more here.


  • (MS12-059) Vulnerability in Microsoft Visio Could Allow Remote Code Execution (2733918)
    Risk Rating: Important

    Microsoft issues a patch for a remote code execution vulnerability that exists in the way certain versions of MS Visio parses specially crafted files. Read more here.


  • (MS12-060) Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2720573)
    Risk Rating: Critical

    This update resolves a vulnerability in MSCOMCTL.OCX, which is found in a host of Microsoft products. When successfully exploited, the vulnerability allows an attacker to remotely execute any code on the vulnerable system. Read more here.


  Information Exposure Rating:

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date IDF Compatibility
MS12-052 CVE-2012-1526 1005132 Microsoft Internet Explorer Layout Memory Corruption Vulnerability (2012-1526) 14-Aug-12 YES

CVE-2012-2521 1005133 Internet Explorer Asynchronous NULL Object Access Remote Code Execution Vulnerability (CVE-2012-2521) 14-Aug-12 YES

CVE-2012-2523 1005134 Internet Explorer JavaScript Integer Overflow Remote Code Execution Vulnerability (CVE-2012-2523) 14-Aug-12 YES

CVE-2012-2522 1005125 Microsoft Internet Explorer Memory Corruption Remote Code Execution Vulnerability (CVE-2012-2522) 14-Aug-12 YES
MS12-053 CVE-2012-2526 1005138 Remote Desktop Protocol Vulnerability (CVE-2012-2526) 14-Aug-12 YES
MS12-054 CVE-2012-1850 1005139 Remote Administration Protocol Denial of Service Vulnerability (CVE-2012-1850) 17-Aug-12 YES

CVE-2012-1851 1005153 Print Spooler Service Format String Vulnerability (CVE-2012-1851) 14-Aug-12 YES

CVE-2012-1852 1005141 Remote Administration Protocol Heap Overflow Vulnerability (CVE-2012-1852) 14-Aug-12 YES

CVE-2012-1853 1005142 Remote Administration Protocol Stack Overflow Vulnerability (CVE-2012-1853) 14-Aug-12 YES
MS12-056 CVE-2012-2523 1005134 Internet Explorer JavaScript Integer Overflow Remote Code Execution Vulnerability (CVE-2012-2523) 14-Aug-12 YES
MS12-059 CVE-2012-1888 1005135 Microsoft Visio DXF File Format Buffer Overflow Vulnerability (CVE-2012-1888) 14-Aug-12 YES
MS12-060 CVE-2012-1856 1005152 Restrict Microsoft Windows TabStrip ActiveX Control 14-Aug-12 YES

  Solutions

Fichier associé