Applied Mitigation Bulletin

IPS signature event data from Cisco Remote Management Services is available for IPS signatures from March 16, 2010.

Contents

Introduction

Microsoft announced two security bulletins that contain eight vulnerabilities as part of the monthly security bulletin release on March 9, 2010. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats), e-mail attachments, and files stored on network shares are in the following list:

• MS10-016
• MS10-017

Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

MS10-016, Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (975561): This vulnerability has been assigned CVE identifier CVE-2010-0265. This vulnerability can be exploited remotely without authentication and requires user interaction.

Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is through Windows Movie Maker software and Microsoft Office Producer software for Microsoft Office PowerPoint 2003, and the manner in which they handle a specially crafted Movie Maker file or Producer file. This vulnerability can be exploited by means of client software, web-based threats (these include but are not limited to cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares.

For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

MS10-017, Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150): These vulnerabilities have been assigned CVE identifiers CVE-2010-0257, CVE-2010-0258, CVE-2010-0260, CVE-2010-0261, CVE-2010-0262, CVE-2010-0263, and CVE-2010-0264. These vulnerabilities can be exploited remotely without authentication and require user interaction.

Successful exploitation of these vulnerabilities may allow arbitrary code execution. The attack vector for exploitation of these vulnerabilities is through Microsoft Office Excel software and the manner in which it handles a specially crafted Excel file. These vulnerabilities can be exploited by means of client software, web-based threats (these include but are not limited to cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares.

For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for March 2010, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks (including cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares are in the following list:

• MS10-016
• MS10-017

These vulnerabilities are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S476 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft March Security Update released on March 9, 2010. This data was gathered from events triggered on March 16, 2010.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S476 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for March 2010
• Cisco Applied Mitigation Bulletins
• Cisco Security Intelligence Operations
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signature Search Page
• Cisco Security Monitoring, Analysis, and Response System
• Cisco Security Agent
• Common Vulnerabilities and Exposures (CVE)

Version 2, March 12, 2010, 4:42 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from March 11, 2010.

Version 1, March 9, 2010, 2:01 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for March 2010.