Severity: : Critical
  Advisory Date: 08 de października de 2013

  DESCRIPTION

Microsoft addresses the following vulnerabilities in its October batch of patches:

  • (MS13-080) Cumulative Security Update for Internet Explorer (2879017)
    Risk Rating: Critical

    This security update addresses a publicly disclosed vulnerability and undisclosed nine vulnerabilities in Internet Explorer. A successful exploit may permit an attacker to execute a malware once user views a malicious webpage via Internet Explorer. Read more here.

  • (MS13-081) Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2870008)
    Risk Rating: Critical

    This security update addresses seven vulnerabilities in Microsoft Windows, which can lead to remote execution of malware once users open a shared content that embeds TrueType or OpenType files. Read more here.

  • (MS13-082) Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2878890)
    Risk Rating: Critical

    This security update addresses three reported vulnerabiilties in Microsoft .NET framework, which may lead to remote malware execution if user visits website with a malicious OpenType font (OTP) file. Read more here.

  • (MS13-083) Vulnerability in Windows Common Control Library Could Allow Remote Code Execution (2864058)
    Risk Rating: Critical

    This security update addresses a vulnerability in Microsoft Windows, which may allow remote execution of malware once attacker sends a malicious web request to ASP.NET web application.Read more here.

  • (MS13-084) Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2885089)
    Risk Rating: Important

    This security update addresses two vulnerabilities in MS Office that may lead to malware execution once user opens a malicious Office file in a vulnerable MS SharePint Server, MS Ofice Services, or Web Apps. Read more here.

  • (MS13-085) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2885080)
    Risk Rating: Important

    This security update addresses two vulnerabilities in Microsoft Office, which may allow remote code execution once users open a malicious Office file with a specific versions of MS Excel or MS Office software. Read more here.

  • (MS13-086) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2885084)
    Risk Rating: Important

    This security update addresses two vulnerabilities in MS Office that may allow malware execution once a malicious file is open using affected versions of MS Word or MS Office. Read more here.

  • (MS13-087) Vulnerability in Silverlight Could Allow Information Disclosure (2890788)
    Risk Rating: Important

    This security update addresses a vulnerability in Silverlight, that may allow unwanted data disclosure if an attacker convinces a user to view a website hosting a malicious Silverlight application. Read more here.

  INFORMATION EXPOSURE

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date IDF Compatibility
MS13-080 CVE-2013-3873 1005707 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3873) 08-Oct-13 YES
MS13-080 CVE-2013-3874 1005702 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3874) 08-Oct-13 YES
MS13-080 CVE-2013-3875 1005704 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3875) 08-Oct-13 YES
MS13-080 CVE-2013-3885 1005706 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3885) 08-Oct-13 YES
MS13-080 CVE-2013-3886 1005701 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3886) 08-Oct-13 YES
MS13-080 CVE-2013-3897 1005703 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3897) 08-Oct-13 YES
MS13-081 CVE-2013-3128 1005708 Microsoft OpenType Font Parsing Vulnerability (CVE-2013-3128) 08-Oct-13 YES
MS13-082 CVE-2013-3128 1005708 Microsoft OpenType Font Parsing Vulnerability (CVE-2013-3128) 08-Oct-13 YES
MS13-082 CVE-2013-3861 1005695 Microsoft Internet Explorer JSON Parsing Vulnerability (CVE-2013-3861) 08-Oct-13 YES
MS13-084 CVE-2013-3895 1000552 Generic Cross Site Scripting(XSS) Prevention 08-Oct-13 No
MS13-080 CVE-2013-3893 1005689 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-3893) 24-Sep-13 YES