2013 年 2 月：マイクロソフト　定例セキュリティ更新プログラム情報

Microsoft addresses the following vulnerabilities in its February batch of patches:

• (MS13-009) Cumulative Security Update for Internet Explorer (2792100)
  Risk Rating: Critical
  
  

  This patch addresses vulnerabilities in Internet Explorer, which can allow remote code execution when exploited thus compromising the security of the affected system. Any remote attacker can gain user rights as the current user once these vulnerabilities are exploited. This update covers 13 vulnerabilities. Read more here.

• (MS13-010) Vulnerability in Vector Markup Language Could Allow Remote Code Execution (2797052)
  Risk Rating: Critical
  
  

  This patch addresses a vulnerability found in Microsoft implementation of Vector Markup Language (VML). It can allow remote code execution once usersview a webpage via Internet Explorer. Read more here.

• (MS13-011) Vulnerability in Media Decompression Could Allow Remote Code Execution (2780091)
  Risk Rating: Critical
  
  

  This patch addresses a vulnerability found in Microsoft Windows. Once an affected user opens a specially crated media file and a Microsoft Office document with a specially crafted embedded media file, it could lead to remote code execution thus compromising the security of the system. Read more here.

• (MS13-012) Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2809279)
  Risk Rating: Critical
  
  

  This patch addresses vulnerabilities found in Microsoft Exchange Server. One of the vulnerabilities, which exists in Microsoft Exchange Server WebReady Document Viewing can allow remote code execution in relation to transcoding service on the Exchange server once affected users user previews a specially crafted file via Outlook Web App (OWA). Read more here.

• (MS13-013) Vulnerabilities in FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution (2784242)
  Risk Rating: Important
  
  

  This patch addresses vulnerabilities found in Microsoft FAST Search Server 2010 for SharePoint. The said vulnerabilities could potentially lead to remote execution. Accordingly, FAST Search Server for SharePoint is affected by this once Advanced Filter Pack is enabled.

  Read more here.

• (MS13-014) Vulnerability in NFS Server Could Allow Denial of Service (2790978)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability in Microsoft Windows, which can allow denial of service when exploited sucessfully. In addition, any remote attacker who successfully exploits this vulnerability can cause the infected system to restart or stop responding.

  Read more here.

• (MS13-015) Vulnerability in .NET Framework Could Allow Elevation of Privilege (2800277)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability found in the .NET Framework. Once users view a specially crafted webpage via a web browser running in XAML Browser Applications, it can allow elevation of privilege. Furthermore, this vulnerability can be leveraged by Windows .NET applications to bypass Code Access Security (CAS) restrictions.

  Read more here.

• (MS13-016) Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778344)
  Risk Rating: Important
  
  

  This patch addresses 30 vulnerabilities found in Microsoft Windows, which can result to elevation of privilege once a remote attacker logs on the affected system and execute a specially crafted application.

  Read more here.

• (MS13-017) Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2799494)
  Risk Rating: Important
  
  

  This patch addresses vulnerabilities in Microsoft Windows, which can allow elevation of privilege once an attacker logs and runs a specially crafted application. Note, however that for a remote attacker to exploit this, he must be able to log on locally.

  Read more here.

• (MS13-018) Vulnerability in TCP/IP Could Allow Denial of Service (2790655)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability found in Microsoft Windows, which could allow denial of service if a remote attacker sends a specially crafted connection termination packet to effectively compromise the system.

  Read more here.

• (MS13-019) Vulnerability in Windows Client/Server Run-time Subsystem (CSRSS) Could Allow Elevation of Privilege (2790113)
  Risk Rating: Important
  
  Read more here.

  This patch addresses a vulnerability found in Microsoft Windows, which could allow elevation of privilege once a remote attacker logs and runs a specially crafted application on the system. Note, however that remote attackers need to log on locally to be able to exploit this.

• (MS13-020) Vulnerability in OLE Automation Could Allow Remote Code Execution (2802968)
  Risk Rating: Critical
  
  

  This patch addresses a vulnerability in Microsoft Windows Object Linking and Embedding (OLE) Automation, which can allow remote code execution when users open a specially crafted file.

  Read more here.