Microsoft Security Bulletins Coverage (April 12, 2011)
SonicWALL has analyzed and addressed Microsoft’s security advisories for the month of April, 2011. A list of issues reported, along with SonicWALL coverage information follows:
MS11-018 Cumulative Security Update for Internet Explorer (2497640)- CVE-2011-0094 – Layouts Handling Memory Corruption Vulnerability
IPS 6432 MS IE Memory Corruption Vulnerability - CVE-2011-0346 – MSHTML Memory Corruption Vulnerability
There is no feasable method of detection. - CVE-2011-1245 – Javascript Information Disclosure Vulnerability
IPS 6435 MS IE Javascript Information Disclosure Vulnerability - CVE-2011-1345 – Object Management Memory Corruption Vulnerability
IPS 6427 MS IE Double Release Object Vulnerability
IPS 6428 MS IE Double Release Object Vulnerability 2
GAV IExploit.A6428
MS11-019 Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)
- CVE-2011-0654 – Browser Pool Corruption Vulnerability
IPS 6248 Generic Netbios Shellcode Exploit - CVE-2011-0660 – SMB Client Response Parsing Vulnerability
IPS 6436 SMB Client Response Parsing Vulnerability Exploit
MS11-020 Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
- CVE-2011-0661 – SMB Transaction Parsing Vulnerability
There is no feasable method of detection.
MS11-021 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279)
- CVE-2011-0097 – Excel Integer Overrun Vulnerability
GAV MS.Xsl.E - CVE-2011-0098 – Excel Heap Overflow Vulnerability
GAV MS.Xsl.E_2 - CVE-2011-0101 – Excel Record Parsing WriteAV Vulnerability
GAV MS.Xsl.E_3 - CVE-2011-0103 – Excel Memory Corruption Vulnerability
GAV MS.Xsl.E_5 - CVE-2011-0104 – Excel Buffer Overwrite Vulnerability
GAV Hlink.BO.A
GAV Hlink.BO.B - CVE-2011-0105 – Excel Data Initialization Vulnerability
GAV MS.Xsl.E_6 - CVE-2011-0978 – Excel Array Indexing Vulnerability
GAV MS.Xsl.E_7 - CVE-2011-0979 – Excel Linked List Corruption Vulnerability
GAV MS.Xsl.E_8 - CVE-2011-0980 – Excel Dangling Pointer Vulnerability
GAV MS.Xsl.E_4
MS11-022 Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2489283)
- CVE-2011-0685 – Floating Point Techno-color Time Bandit RCE Vulnerability
GAV MS.Ppt.E - CVE-2011-0656 – Persist Directory RCE Vulnerability
GAV MS.Ppt.E_2 - CVE-2011-0976 – OfficeArt Atom RCE Vulnerability
GAV MS.Ppt.E_3
MS11-023 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293)
- CVE-2011-0107 – Office Component Insecure Library Loading Vulnerability
IPS 5726 Possible Binary Planting Attempt - CVE-2011-0977 – Microsoft Office Graphic Object Dereferencing Vulnerability
GAV MS.Xsl.E_9
MS11-024 Vulnerability in Windows Fax Cover Page Editor Could Allow Remote Code Execution (2527308)
- CVE-2010-3974 – Fax Cover Page Editor Memory Corruption Vulnerability
GAV MS.cov.E
- CVE-2010-3190 – MFC Insecure Library Loading Vulnerability
IPS 5726 Possible Binary Planting Attempt
MS11-026 Vulnerability in MHTML Could Allow Information Disclosure (2503658)
- CVE-2011-0096 – MHTML Mime-Formatted Request Vulnerability
IPS 6205 MHTML Protocol Handler XSS Attack Attempt 4
MS11-027 Cumulative Security Update of ActiveX Kill Bits (2508272)
- CVE-2010-0811 – Microsoft Internet Explorer 8 Developer Tools Vulnerability
IPS 6437 MS Windows IE8 Developer Tools ActiveX Invocation Attempt - CVE-2010-3973 – Microsoft WMITools ActiveX Control Vulnerability
IPS 6434 MS Windows WMITools ActiveX Control Invocation Attempt - CVE-2011-1243 – Microsoft Windows Messenger ActiveX Control Vulnerability
IPS 6433 MS Windows Live Messenger ActiveX invocation attempt
MS11-028 Vulnera
bility in .NET Framework Could Allow Remote Code Execution (2484015)
- CVE-2010-3958 – NET Framework Stack Corruption Vulnerability
This is a local vulnerability.
MS11-029 Vulnerability in GDI+ Could Allow Remote Code Execution (2489979)
- CVE-2011-0041 – GDI+ Integer Overflow Vulnerability
GAV ms11-029.ms
MS11-030 Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
- CVE-2011-0657 – DNS Query Vulnerability
There is no feasable method of detection.
- CVE-2011-0663 – Scripting Memory Reallocation Vulnerability
There is no feasable method of detection.
- CVE-2011-0034 – OpenType Font Stack Overflow Vulnerability
IPS 6438 MS OpenType Font Stack Overflow Exploit
MS11-033 Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2485663)
- CVE-2011-0028 – WordPad Converter Parsing Vulnerability
GAV ms11-033.ms.ttextflow
GAV ms11-033.ms.tsplit
MS11-034 Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2506223)
- CVE-2011-0662 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0665 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0666 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0667 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0670 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0671 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0672 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0673 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-0674 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0675 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-0676 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-0677 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1225 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1226 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1227 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1228 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1229 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1230 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1231 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1232 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1233 – Win32k Null Pointer De-reference Vulnerability
Local authenticated vulnerability - CVE-2011-1234 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1235 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1236 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1237 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1238 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1239 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1240 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1241 – Win32k Use After Free Vulnerability
Local authenticated vulnerability - CVE-2011-1242 – Win32k Use After Free Vulnerability
Local authenticated vulnerability