• IDP Daily Update #1328
  posted: 12/12/08
  
• NSM Daily Update #1328
  posted: 12/12/08
  
• Deep Inspection 5.3r5 and above, 5.4, 6.0 #1328
  posted: 12/12/08
  
• Deep Inspection 5.1, 5.2, 5.3r4 and below #1321
  posted: 12/12/08
  
• Deep Inspection 5.0 #1132
  posted: 04/01/08
  
• Antivirus
  posted: 12/12/08

Text Size:        

• See Also
• Current Updates

• Microsoft Security Resources
• Security Incidents
• Security Resources

• Juniper Networks Product Solutions for Microsoft
• Get detailed information about Juniper solutions that protect your Microsoft environment:
• SSL VPNs
• Intrusion Prevention
• Firewall / VPN Central Management34 KB
• VPN Resiliency594 KB
• Denial of Service and Attack Prevention754 KB
• Antivirus Protection55 KB

October 2008

---

Prior Updates:

---

Login to learn more about how Juniper Networks products can protect you from these vulnerabilities. (If you don't already have a login, see Requesting Support.)

October 2008

Microsoft Security Bulletin MS08-056

Vulnerability in Microsoft Office Could Allow Information Disclosure (957699)

Severity: Moderate
Vulnerabilities:

• Vulnerability in Content-Disposition Header Vulnerability - CVE-2008-4020
  A vulnerability exists in the way that Office process documents using the CDO Protocol (cdo:) and the Content-Disposition: Attachment header. These documents may be incorrectly rendered in the web browser, leading to cross-site scripting.

Microsoft Security Bulletin MS08-057

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (956416)

Severity: Critical
Vulnerabilities:

• Calendar Object Validation Vulnerability - CVE-2008-3477
  A remote code execution vulnerability exists in the way Excel processes a compiled VBA Project. Compiled VBA projects should, by default, be consider un-trusted unless expressly determined to be trusted by the user. This vulnerability incorrectly implies a trusted relationship for complied VBA Projects.
• File Format Parsing Vulnerability - CVE-2008-3471
  A remote code execution vulnerability exists in the way Excel processes objects when loading Excel files into memory by improperly validating the amount of memory stored by the allocated memory block. An attacker could exploit the vulnerability by opening a specially crafted file which could be hosted on a Web site, or included as an e-mail attachment.
• Formula Parsing Vulnerability - CVE-2008-4019
  The specific flaw exists when parsing Microsoft Excel documents containing a malformed formula embedded inside a cell. During evaluation of this cell Excel miscalculates the size of a static buffer and copies the result of the formula into it resulting in an exploitable condition. This can result in a remote compromise of the system under the credentials of the currently logged in user.

Microsoft Security Bulletin MS08-058

Cumulative Security Update for Internet Explorer (956390)

Severity: Critical
Vulnerabilities:

• Window Location Property Cross-Domain Vulnerability - CVE-2008-2947
  A remote code execution and information disclosure vulnerability exists in Internet Explorer where an the attacker could gain access to another browser window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow remote code execution or information disclosure, depending on the operating system, if a user viewed the Web page.
• HTML Element Cross-Domain Vulnerability - CVE-2008-3472
  A remote code execution and information disclosure vulnerability exists in Internet Explorer where script can gain access to another browser window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow remote code execution or information disclosure, depending on the operating system, if a user viewed the Web page.
• Event Handling Cross-Domain Vulnerability - CVE-2008-3473
  A remote code execution and information disclosure vulnerability exists in Internet Explorer where script can gain access to another browser window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow remote code execution or information disclosure, depending on the operating system, if a user viewed the Web page.
• Cross-Domain Information Disclosure Vulnerability - CVE-2008-3474
  An information disclosure vulnerability exists in Internet Explorer where script can gain access to another browser window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page.
• Uninitialized Memory Corruption Vulnerability - CVE-2008-3475
  A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or that has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
• HTML Objects Memory Corruption Vulnerability - CVE-2008-3476
  A remote code execution vulnerability exists in Internet Explorer due to attempts to access uninitialized memory in certain situations. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.

Microsoft Security Bulletin MS08-059

Vulnerability in Host Integration Server RPC Service Could Allow Remote Code Execution (956695)

Severity: Critical
Vulnerabilities:

• HIS RPC Buffer Overflow Vulnerability - CVE- 2008-3466
  A remote code execution vulnerability exists in the SNA Remote Procedure Call (RPC) service for Host Integration Server. An attacker could exploit the vulnerability by constructing a specially crafted RPC request. The vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS08-060

Vulnerability in Active Directory Could Allow Remote Code Execution(957280)

Severity: Critical
Vulnerabilities:

• Active Directory Overflow Vulnerability - CVE-2008-4023
  A remote code execution vulnerability exists in implementations of Active Directory on Microsoft Windows 2000 Server. The vulnerability is due to incorrect memory allocation when receiving specially crafted LDAP requests. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS08-061

Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege(954211)

Severity: Important
Vulnerabilities:

• Windows Kernel Window Creation Vulnerability - CVE-2008-2250
  An elevation of privilege vulnerability exists because the Windows kernel does not properly validate properties of a window passed during the new window creation process. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
• Windows Kernel Memory Corruption Vulnerability - CVE-2008-2252
  An elevation of privilege vulnerability exists due to the Windows kernel improperly validating input passed from user mode to the kernel. The vulnerability could allow an attacker to run code with elevated privileges. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Microsoft Security Bulletin MS08-062

Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution(953155)

Severity: Important
Vulnerabilities:

• Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution(953155)
  A remote code execution vulnerability exists on Windows systems running IIS with the internet printing service enabled. This issue could allow a remote, authenticated attacker to execute arbitrary code on an affected system.

Microsoft Security Bulletin MS08-063

Vulnerability in SMB could allow Remote Code Execution (957095)

Severity: Important
Vulnerabilities:

• SMB Buffer Underflow Vulnerability - CVE-2008-4038
  A remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol handles specially crafted files names. The vulnerability requires authentication because the vulnerable function is only reachable when the share type is a disk, and by default, all disk shares require authentication. An attacker who successfully exploited this vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.

Microsoft Security Bulletin MS08-064

Vulnerability in Virtual Address Descriptor Manipulation Could Allow Elevation of Privilege(956841)

Severity: Important
Vulnerabilities:

• Virtual Address Descriptor Elevation of Privilege Vulnerability - CVE-2008-4036
  An elevation of privilege vulnerability exists in the way that Memory Manager handles memory allocation and Virtual Address Descriptors (VADs). The vulnerability could allow elevation of privilege if an authenticated attacker runs a specially crafted program on an affected system. An attacker who successfully exploited this vulnerability could gain elevation of privilege on an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

Microsoft Security Bulletin MS08-065

Vulnerability in Message Queuing Could Allow Remote Code Execution (951071)

Severity: Important
Vulnerabilities:

• Message Queuing Service Remote Code Execution Vulnerability - CVE-2008-3479
  A remote code execution vulnerability exists in the Message Queuing Service due to a specific flaw in the parsing of an RPC request to the Message Queuing service. An attacker could exploit the vulnerability by sending a specially crafted RPC request, a heap calculation can be controlled and later overflowed during an unchecked string copy operation. Successful exploitation of this issue leads to full access of the affected system under the SYSTEM context. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS08-066

Vulnerability in the Microsoft Ancillary Function Driver Could Allow Elevation of Privilege(956803)

Severity: Important
Vulnerabilities:

• AFD Kernel Overwrite Vulnerability - CVE-2008-3464
  An elevation of privilege vulnerability exists in the Ancillary Function Driver (afd.sys) due to Windows improperly validating input passed from user mode to the kernel. The vulnerability could allow an attacker to run code with elevated privileges. A local attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Microsoft Security Bulletin MS08-067

Vulnerability in Server Service Could Allow Remote Code Execution (958644)

Severity: Critical
Vulnerabilities:

• Vulnerability in Server Service Could Allow Remote Code Execution (958644)
  A remote code execution vulnerability exists in the Server service on Windows systems. The vulnerability is due to the service not properly handling specially crafted RPC requests. An attacker who successfully exploited this vulnerability could take complete control of an affected system.