Microsoft Security Bulletin Coverage (Feb 14, 2012)

SonicWALL has analyzed and addressed Microsoft’s security advisories for the month of February, 2012. A list of issues reported, along with SonicWALL coverage information follows:

MS12-008 Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2660465)

• CVE-2011-5046 GDI Access Violation Vulnerability
  IPS: 7292 – Suspicious HTML Iframe Tag 1
  IPS: 7378 – Suspicious HTML Iframe Tag 2
• CVE-2012-0154 Keyboard Layout Use After Free Vulnerability
  This is a local elevation of privilege vulnerability.

MS12-009 Vulnerabilities in Ancillary Function Driver Could Allow Elevation of Privilege (2645640)

• CVE-2012-0148 AfdPoll Elevation of Privilege Vulnerability
  This is a local elevation of privilege vulnerability.
• CVE-2012-0149 Ancillary Function Driver Elevation of Privilege Vulnerability
  This is a local elevation of privilege vulnerability.

MS12-010 Cumulative Security Update for Internet Explorer (2647516)

• CVE-2012-0010 Copy and Paste Information Disclosure Vulnerability
  There is no feasible method of detection.
• CVE-2012-0011 HTML Layout Remote Code Execution Vulnerability
  IPS: 7400 – Windows IE HTML Layout Remote Code Execution
• CVE-2012-0012 Null Byte Information Disclosure Vulnerability
  IPS: 7401 – Windows IE Null Byte Information Disclosure
• CVE-2012-0155 VML Remote Code Execution Vulnerability
  IPS: 7400 – Windows IE HTML Layout Remote Code Execution

MS12-011 Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2663841)

• CVE-2012-0017 XSS in inplview.aspx Vulnerability
  IPS: 7402 – MS SharePoint inplview.aspx XSS Attack
• CVE-2012-0144 XSS in themeweb.aspx Vulnerability
  IPS: 7403 – MS SharePoint themeweb.aspx XSS Attack
• CVE-2012-0145 XSS in wizardlist.aspx Vulnerability
  IPS: 7411 – MS SharePoint wizardlist.aspx XSS Attack

MS12-012 Vulnerability in Color Control Panel Could Allow Remote Code Execution (2643719)

• CVE-2010-5082 Color Control Panel Insecure Library Loading Vulnerability
  IPS: 1023 – Binary Planting Attempt 1
  IPS: 5726 – Binary Planting Attempt 2
  IPS: 6847 – Binary Planting Attempt 3

MS12-013 Vulnerability in C Run-Time Library Could Allow Remote Code Execution (2654428)

• CVE-2012-0150 Msvcrt.dll Buffer Overflow Vulnerability
  IPS: 7412 – Microsoft C Run-Time Library Remote Code Execution

MS12-014 Vulnerability in Indeo Codec Could Allow Remote Code Execution (2661637)

• CVE-2010-3138 Indeo Codec Insecure Library Loading Vulnerability
  IPS: 1023 – Binary Planting Attempt 1
  IPS: 5726 – Binary Planting Attempt 2
  IPS: 6847 – Binary Planting Attempt 3

MS12-015 Vulnerabilities in Microsoft Visio Viewer 2010 Could Allow Remote Code Execution (2663510)

• CVE-2012-0019 VSD File Format Memory Corruption Vulnerability
  IPS: 7406 – Malformed Visio Document 5b
• CVE-2012-0020 VSD File Format Memory Corruption Vulnerability
  IPS: 7407 – Malformed Visio Document 6b
• CVE-2012-0136 VSD File Format Memory Corruption Vulnerability
  IPS: 7408 – Malformed Visio Document 7b
• CVE-2012-0137 VSD File Format Memory Corruption Vulnerability
  IPS: 7409 – Malformed Visio Document 8b
• CVE-2012-0138 VSD File Format Memory Corruption Vulnerability
  IPS: 7410 – Malformed Visio Document 9b

MS12-016 Vulnerabilities in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2651026)

• CVE-2012-0014 .NET Framework Unmanaged Objects Vulnerability
  IPS: 7404 – Microsoft Silverlight Remote Code Execution 1
• CVE-2012-0015 .NET Framework Heap Corruption Vulnerability
  IPS: 7405 – Microsoft Silverlight Remote Code Execution 2

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.