Gravité: : Élevé
  Date du conseil: 09 août 2011

  Description

Microsoft addresses the following vulnerabilities in its August batch of patches:

  • (MS11-057) Cumulative Security Update for Internet Explorer (2559049)
    Risk Rating: Critical

    This security update addresses five privately and two publicly reported bugs in Internet Explorer, the most severe of which may lead to arbitrary code execution. The possible exploit scenario may include a user who views a maliciously-crafted Web page using Internet Explorer. Exploiting any of these vulnerabilities could give an attacker the same user right as the local user. Read more here.

  • (MS11-058) Vulnerabilities in DNS Server Could Allow Remote Code Execution (2562485)
    Risk Rating: Critical

    This security update resolves two reported vulnerabilities in Windows DNS Server which could lead to arbitrary code execution once a potential attacker registers a domain, create NAPTR DNS record and send a malicious NAPTR query to a particular DNS server. Read more here.

  • (MS11-059) Vulnerability in Data Access Components Could Allow Remote Code Execution (2560656)
    Risk Rating: Important

    This security update addresses a vulnerability in Microsoft Windows that may lead to remote code execution once a user opens a non-malicious Excel file located in the same network directory as a malicious library file. Read more here.


  • (MS11-060) Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2560978)
    Risk Rating: Important

    This security update addresses two vulnerability in Microsoft Visio that may allow an attacker to execute arbitrary code if unwitting user opens a specific Visio file. Exploiting these bugs may also allow an attacker to gain same user right as logged-on user. Read more here.

  • (MS11-061) Vulnerability in Remote Desktop Web Access Could Allow Elevation of Privilege (2546250)
    Risk Rating: Important

    This security update resolves a vulnerability in Remote Desktop Web Access. Specifically, it is a cross-site (XSS) vulnerability that could allow privilege elevation, which enables a potential attacker to execute malicious code on the affected system. Read more here.


  • (MS11-062) Vulnerability in Remote Access Service NDISTAPI Driver Could Allow Elevation of Privilege (2566454)
    Risk Rating: Important

    This security update addresses a vulnerability in Windows XP and Windows Server 2003. Systems running on Windows Vista, Server 2008, Windows 7, and Server 2008 R2 are not affected. Successfully exploiting this may allow elevation of privilege. Read more here.


  • (MS11-063) Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege (2567680)
    Risk Rating: Important

    This security update addresses a reported vulnerability in Microsoft Windows that could give elevation of privilege to a potential attacker. Read more here.


  • (MS11-064) Vulnerabilities in TCP/IP Stack Could Allow Denial of Service (2563894)
    Risk Rating: Important

    This security update addresses two vulnerability in Microsoft Windows that could allow denial of service if an atatcker sends several malicious Internet Control Message Protocol (ICMP) messages or a malicious URL request to a server. Read more here.


  • (MS11-065) Vulnerability in Remote Desktop Protocol Could Allow Denial of Service (2570222)
    Risk Rating: Important

    This security update fixes a vulnerability in the Remote Desktop Protocol, which may allow denial of service if a system receives a series of malicious RDP packets. Read more here.


  • (MS11-066) Vulnerability in Microsoft Chart Control Could Allow Information Disclosure (2567943)
    Risk Rating: Important

    This security update resolves a vulnerability in ASP.NET Chart controls that may lead to unwanted data disclosure if a remote user sends a malicious GET request to a specific server. Read more here.


  • (MS11-067) Vulnerability in Microsoft Report Viewer Could Allow Information Disclosure (2578230)
    Risk Rating: Important

    This security update fixes a vulnerability in Microsoft Report Viewer that could result to unwanted information disclosure once a user views a specific malicious Weg page. An attacker may convince users to visit the said site via several infection vectors such as spammed message. Read more here.


  • (MS11-068) Vulnerability in Windows Kernel Could Allow Denial of Service (2556532)
    Risk Rating: Medium

    This security update resolves a vulnerability in Microsoft Windows that may lead to denial of service if user visits a specific network share (or a Web site that points to it) that contains a malicious file. Read more here.


  • (MS11-069) Vulnerability in .NET Framework Could Allow Information Disclosure (2567951)
    Risk Rating: Medium

    This security update addresses a vulnerability in Microsoft .NET Framework that could lead to information disclosure once user views a malicious Web page using a browser that can run XAML Browser Applications. Read more here.


  Information Exposure Rating:

Trend Micro Deep Security shields the following vulnerabilities using the specified rules. Trend Micro customers using OfficeScan with the Intrusion Defense Firewall plugin are also protected from attacks using these vulnerabilities.
Microsoft Bulletin ID Vulnerability ID Identifier & Title Deep Security Pattern Version Deep Security Pattern Release Date
MS11-057 CVE-2011-1257 1004758 - Microsoft Internet Explorer Windows Open Race Condition Vulnerability (CVE-2011-1257) 11-024 Aug 10, 2011
CVE-2011-1963 1004759 - XSLT Memory Corruption Vulnerability (CVE-2011-1963) 11-024 Aug 10, 2011
MS11-058 CVE-2011-1966 1004761 - DNS NAPTR Query Vulnerability (CVE-2011-1966) 11-024 Aug 10, 2011
MS11-059 CVE-2011-1975 1004773 - Data Access Components Insecure Library Loading Vulnerability (CVE-2011-1975) 11-024 Aug 10, 2011
CVE-2011-1975 1004762 - Data Access Components Insecure Library Loading Vulnerability Over Network Share (CVE-2011-1975) 11-025 Aug 24, 2011
MS11-066 CVE-2011-1977 1004756 - Microsoft Chart Control Directory Traversal Vulnerability (CVE-2011-1977) 11-024 Aug 10, 2011

  OtherInformation