November 2012 - Microsoft Releases 6 Security Advisories

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

  Severity: CRITICAL

  Advisory Date: NOV 13, 2012

---

  DESCRIPTION

Microsoft addresses the following vulnerabilities in its November batch of patches:

• (MS12-071) Cumulative Security Update for Internet Explorer (2761451)
  Risk Rating: Critical
  
  This patch addresses vulnerabilities in Internet Explorer that could allow remote code execution via a specially crafted web page. Read more here.



• (MS12-072) Vulnerabilities in Windows Shell Could Allow Remote Code Execution (2727528)
  Risk Rating: Critical
  
  This patch addresses vulnerabilities in Microsoft Windows, which could allow remote code execution via a specially crafted briefcase in Windows Explorer. Read more here.



• (MS12-073) Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Information Disclosure (2733829)
  Risk Rating: Medium
  
  This patch addresses two vulnerabilities affecting Microsoft Internet Information Services (IIS). Read more here.



• (MS12-074) Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2745030)
  Risk Rating: Critical
  
  This patch addresses vulnerabilities existing in the .NET Framework. Read more here.



• (MS12-075) Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2761226)
  Risk Rating: Critical
  This patch addresses vulnerabilities affecting Microsoft Windows. Read more here.



• (MS12-076) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2720184)
  Risk Rating: Important
  
  This patch addresses vulnerabilities existing in Microsoft Office, which could allow remote code execution once users opens a specially crafted Excel file. Read more here.

  TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID	Vulnerability ID	DPI Rule Number	DPI Rule Name	Release Date	IDF Compatibility
MS12-071	CVE-2012-1538	1005240	Microsoft Internet Explorer CFormElement Use After Free Vulnerability	13-Nov-12	YES
	CVE-2012-1539	1005244	Microsoft Internet Explorer CTreePos Use After Free Vulnerability	13-Nov-12	YES
	CVE-2012-4775	1005246	Microsoft Internet Explorer CTreeNode Use After Free Vulnerability	13-Nov-12	YES
MS12-072	CVE-2012-1527	1005238	Microsoft Windows Briefcase Integer Underflow Vulnerability	13-Nov-12	YES
	CVE-2012-1528	1005243	Microsoft Windows Briefcase Integer Overflow Vulnerability	13-Nov-12	YES
MS12-074		1004373	Identified Microsoft DLL File Over Network Share	13-Nov-12	YES
		1005241	Identified Suspicious Web Proxy Via Auto-Discovery	13-Nov-12	YES
MS12-075	CVE-2012-2897	1005239	Microsoft Windows Font Parsing Vulnerability	13-Nov-12	YES
MS12-076	CVE-2012-1885	1005245	Microsoft Excel SerAuxErrBar Heap Overflow Vulnerability	13-Nov-12	YES