Severity: : Critical
  Advisory Date: 13 de ноября de 2012

  DESCRIPTION

Microsoft addresses the following vulnerabilities in its November batch of patches:


  • (MS12-071) Cumulative Security Update for Internet Explorer (2761451)
    Risk Rating: Critical

    This patch addresses vulnerabilities in Internet Explorer that could allow remote code execution via a specially crafted web page. Read more here.


  • (MS12-072) Vulnerabilities in Windows Shell Could Allow Remote Code Execution (2727528)
    Risk Rating: Critical

    This patch addresses vulnerabilities in Microsoft Windows, which could allow remote code execution via a specially crafted briefcase in Windows Explorer. Read more here.


  • (MS12-073) Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Information Disclosure (2733829)
    Risk Rating: Medium

    This patch addresses two vulnerabilities affecting Microsoft Internet Information Services (IIS). Read more here.


  • (MS12-074) Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2745030)
    Risk Rating: Critical

    This patch addresses vulnerabilities existing in the .NET Framework. Read more here.


  • (MS12-075) Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2761226)
    Risk Rating: Critical
    This patch addresses vulnerabilities affecting Microsoft Windows. Read more here.


  • (MS12-076) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2720184)
    Risk Rating: Important

    This patch addresses vulnerabilities existing in Microsoft Office, which could allow remote code execution once users opens a specially crafted Excel file. Read more here.


  INFORMATION EXPOSURE

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date IDF Compatibility
MS12-071 CVE-2012-1538 1005240 Microsoft Internet Explorer CFormElement Use After Free Vulnerability 13-Nov-12 YES

CVE-2012-1539 1005244 Microsoft Internet Explorer CTreePos Use After Free Vulnerability 13-Nov-12 YES

CVE-2012-4775 1005246 Microsoft Internet Explorer CTreeNode Use After Free Vulnerability 13-Nov-12 YES
MS12-072 CVE-2012-1527 1005238 Microsoft Windows Briefcase Integer Underflow Vulnerability 13-Nov-12 YES
CVE-2012-1528 1005243 Microsoft Windows Briefcase Integer Overflow Vulnerability 13-Nov-12 YES
MS12-074
1004373 Identified Microsoft DLL File Over Network Share 13-Nov-12 YES


1005241 Identified Suspicious Web Proxy Via Auto-Discovery 13-Nov-12 YES
MS12-075 CVE-2012-2897 1005239 Microsoft Windows Font Parsing Vulnerability 13-Nov-12 YES
MS12-076 CVE-2012-1885 1005245 Microsoft Excel SerAuxErrBar Heap Overflow Vulnerability 13-Nov-12 YES