2012 年 10 月：マイクロソフト　定例セキュリティ更新プログラム情報

2013年2月20日

危険度: : 高

情報公開日: 10 09, 2012

概要

Microsoft addresses the following vulnerabilities in its October batch of patches:

(MS12-064) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2742319)
Risk Rating: Critical

This security update addresses vulnerabilities affecting Microsoft Office. When successfully exploited, it could allow remote code execution via a specially crafted .RTF file. Read more here.

(MS12-065) Vulnerability in Microsoft Works Could Allow Remote Code Execution (2754670)
Risk Rating: Important

This patch addresses a vulnerability affecting Microsoft Works that exists in Microsoft Works 9. Read more here.

(MS12-066) Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege (2741517)
Risk Rating: Important

This patch addresses a vulnerability affecting Microsoft Office, Microsoft Communications Platforms, Microsoft Server software, and Microsoft Office Web Apps. Read more here.

(MS12-067) Vulnerabilities in FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution (2742321)
Risk Rating: Important

This patch addresses vulnerabilities existing in Microsoft FAST Search Server 2010 for SharePoint. When exploited, it could allow remote code execution in the security context (user accounts) with a token. Read more here.

(MS12-068) Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2724197)
Risk Rating: Important

This patch addresses a vulnerability existing in all supported releases of Microsoft Windows with the exception of Windows 8 and Windows Server 2012. Read more here.

(MS12-069) Vulnerability in Kerberos Could Allow Denial of Service (2743555)
Risk Rating: Important

This patch addresses a vulnerability existing in Microsoft Windows. It could allow denial of service attacks when a remote attacker sends a specially crafted request to the Kerberos server. Read more here.

(MS12-070) Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849)
Risk Rating: Important

This patch addresses a vulnerability existing in Microsoft SQL Server on systems with SQL Server Reporting Services (SSRS). It is a cross-site scripting vulnerability that could allow attackers to execute arbitrary commands on the SSRS site. Read more here.

マイクロソフトは、2012 年 10 月の定例セキュリティ更新プログラムをリリースし、以下の脆弱性に対応しています。

MS12-067：FAST Search Server 2010 for SharePoint の解析の脆弱性により、リモートでコードが実行される (2742321)
危険度: 高

詳しくはこちら

トレンドマイクロのサーバ向け総合セキュリティ製品「Trend Micro Deep Security（トレンドマイクロディープセキュリティ）」は、以下の「Deep Packet Inspection（DPI）」を介してネットワークを保護します。また、「Trend Micro 脆弱性対策オプション（ウイルスバスターコーポレートエディションプラグイン製品）」をご利用のユーザも、これらの脆弱性から保護されます。

Microsoft セキュリティ情報 ID	CVE識別番号	DPIフィルタ番号	DPIフィルタ名	DPIリリース日	脆弱性対策オプションとの互換性
MS12-064	CVE-2012-2528	1005214	Microsoft RTF File listid Use-After-Free Vulnerability	2012年10月9日	あり
	CVE-2012-0182	1005223	Microsoft Word PAPX Section Corruption Vulnerability (CVE-2012-0182)	2012年10月24日	あり
MS12-065	CVE-2012-2550	1005215	Microsoft Works Heap Vulnerability	2012年10月9日	あり
MS13-066	CVE-2012-2520	1000522	Generic Cross Site Scripting(XSS) Prevention	2007年7月18日	なし
MS13-069	CVE-2012-2551	1000552	Generic Cross Site Scripting(XSS) Prevention	2007年7月18日	なし