Microsoft announced two security bulletins that contain eight vulnerabilities as part of the monthly security bulletin release on March 9, 2010. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.
The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats), e-mail attachments, and files stored on network shares are in the following list:
Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.
MS10-016, Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (975561): This vulnerability has been assigned CVE identifier CVE-2010-0265. This vulnerability can be exploited remotely without authentication and requires user interaction.
Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is through Windows Movie Maker software and Microsoft Office Producer software for Microsoft Office PowerPoint 2003, and the manner in which they handle a specially crafted Movie Maker file or Producer file. This vulnerability can be exploited by means of client software, web-based threats (these include but are not limited to cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares.
MS10-017, Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150): These vulnerabilities have been assigned CVE identifiers CVE-2010-0257, CVE-2010-0258, CVE-2010-0260, CVE-2010-0261, CVE-2010-0262, CVE-2010-0263, and CVE-2010-0264. These vulnerabilities can be exploited remotely without authentication and require user interaction.
Successful exploitation of these vulnerabilities may allow arbitrary code execution. The attack vector for exploitation of these vulnerabilities is through Microsoft Office Excel software and the manner in which it handles a specially crafted Excel file. These vulnerabilities can be exploited by means of client software, web-based threats (these include but are not limited to cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares.
The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks (including cross-site scripting, phishing, and web-based e-mail), e-mail attachments, and files stored on network shares are in the following list:
These vulnerabilities are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.
Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.
The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.
Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.
Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.
Specific information about mitigation and identification is available for these devices:
Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.
Windows Movie Maker Buffer Overflow
Microsoft Office Remote Code Execution
Microsoft Excel Remote Code Execution
Microsoft Excel Memory Corruption
Microsoft Office Excel MDXSET Record Heap Overflow Exploit
Microsoft Office Excel FNGROUPNAME Record Memory Vulnerability
MS Office Excel XLSX File Parsing Code Execution
Microsoft Excel Remote Code Execution
* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.
Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.
Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.
Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.
The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S476 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft March Security Update released on March 9, 2010. This data was gathered from events triggered on March 16, 2010.
Percentage of Sensors Reporting the Signature
Percentage of Sensors Reporting the Signature Among Top Ten Most-Seen Events
Identification: Cisco Security Monitoring, Analysis, and Response System Incidents
The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S476 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.
MARS Query Keyword(s)
NR-24779 or NR-24779/0
NR-24779 or NR-24779/1
NR-24579 or NR-24579/0
NR-24579 or NR-24579/1
Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.
Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.
By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:
System Rule: CS-MARS IPS Signature Update Failure
When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.
Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Cisco IP Interoperability and Collaboration System
Cisco IP Queue Manager
Cisco Media Blender
3.0 Base | 4.0 Base | 5.0 (0)_SR1, (0)_SR2, Base | Original Release Base
Cisco Networking Services for Active Directory
Original Release Base
Cisco Outbound Option
Original Release Base
Cisco Personal Assistant
1.0 (1), Base | 1.1 Base | 1.3 .1, .2, .3, .4, Base | 1.4 .2, .3, .4, .5, .6, Base
Cisco Remote Monitoring Suite Option
1.0 Base | 2.0 (0)_SR1, Base
Cisco Secure Access Control Server (ACS) for Windo
2.6 Base | 188.8.131.52 Base | 2.6.4 Base | 184.108.40.206 Base | 3.0 Base | 3.0.1 Base | 220.127.116.11 Base | 3.0.2 Base | 3.0.3 Base | 18.104.22.168 Base | 3.0.4 Base | 3.1.1 Base | 22.214.171.124 Base | 3.1.2 Base | 3.2 Base | 3.2.1 Base | 3.2.3 Base | 3.3.1 Base | 126.96.36.199 Base | 188.8.131.52 Base | 184.108.40.206 Base | 4.0 Base | 4.0.1 Base | 220.127.116.11 Base | 18.104.22.168 Base
Cisco Secure Access Control Server Solution Engine
3.1 .1, Base | 3.2 .1.20, .2.5 , .3, Base | 3.3 .1, .1.16, .2.2, .3, .4, .4.12, Base | 4.0 .1, .1.42, .1.44, .1.49, Base | 4.1 .1.23, .1.23.3, .3, .3.12, Base
Cisco Secure User Registration Tool (URT)
1.2 .1, Base | 2.0 .7, .8, Base | 2.5 .1, .2, .3, .4, .5, Base | Original Release Base
2.0 Base | 2.1 Base | 2.2 .1, Base | 3.0 .1, .2, Base | 3.1 Base | 3.2 Base | 4.0 Base | 4.1 .4, .6, .6.6.1, Base | 4.6 Base | 4.7 Base | 5.0 .0.867.2, .1.873.2, .2, .2.105.1, .2.110.1, .2.92.1, .2.99.1, Base | 6.0 .0.405.1, .0.407.1, .0.412.1, Base | 7.0 .0.370.1, .0.372.1, .0.377.1 , .0.389.1, .0.400.1, .395.1, Base | 7.2 .0.199.1, Base | Original Release Base
Cisco Unified Communications Manager
1.0 Base | 2.0 Base | 3.0 Base | 3.0.3(a) Base | 3.1 .1, .2, .3a, Base | 3.1(1) Base | 3.1(2) Base | 3.1(2)SR3 Base | 3.1(3) Base | 3.1(3)SR2 Base | 3.1(3)SR4 Base | 3.2 Base | 3.2(3)SR3 Base | 3.3 Base | 3.3(2)SPc Base | 3.3(3) Base | 3.3(3)ES61 Base | 3.3(3)SR3 Base | 3.3(3)SR4a Base | 3.3(3a) Base | 3.3(4) Base | 3.3(4)ES25 Base | 3.3(4)SR2 Base | 3.3(4c) Base | 3.3(5) Base | 3.3(5)ES24 Base | 3.3(5)SR1 Base | 3.3(5)SR1a Base | 3.3(5)SR2 Base | 3.3(5)SR2a Base | 3.3(5)SR3 Base | 3.3(59) Base | 3.3(61) Base | 3.3(63) Base | 3.3(64) Base | 3.3(65) Base | 3.3(66) Base | 3.3(67.5) Base | 3.3(68.1) Base | 3.3(71.0) Base | 3.3(74.0) Base | 3.3(76) Base | 3.3(78) Base | 4.0 .1, .2 | 4.0(2a)ES40 Base | 4.0(2a)ES56 Base | 4.0(2a)SR2b Base | 4.0(2a)SR2c Base | 4.1 Base | 4.1(17) Base | 4.1(19) Base | 4.1(2) Base | 4.1(2)ES33 Base | 4.1(2)ES50 Base | 4.1(2)SR1 Base | 4.1(22) Base | 4.1(23) Base | 4.1(25) Base | 4.1(26) Base | 4.1(27.7) Base | 4.1(28.2) Base | 4.1(3) Base | 4.1(3)ES Base | 4.1(3)ES07 Base | 4.1(3)ES24 Base | 4.1(3)SR Base | 4.1(3)SR1 Base | 4.1(3)SR2 Base | 4.1(3)SR3 Base | 4.1(3)SR3b Base | 4.1(3)SR3c Base | 4.1(3)SR4 Base | 4.1(3)SR4b Base | 4.1(3)SR4d Base | 4.1(3)SR5 Base | 4.1(30.4) Base | 4.1(36) Base | 4.1(39) Base | 4.1(4) Base | 4.1(9) Base | 4.2(1.02) Base | 4.2(1.05.3) Base | 4.2(1.06) Base | 4.2(1.07) Base | 4.2(1) Base | 4.2(1)SR1b Base | 4.2(3.08) Base | 4.2(3.13) Base | 4.2(3.2.3) Base | 4.2(3.3) Base | 4.2(3) Base | 4.2(3)SR1 Base | 4.2(3)SR2 Base | 4.3(1.57) Base | 4.3(1) Base | 4.3(1)SR Base | Original Release Base
4.3 Base | 5.2 Base | 5.3 Base | 5.4 Base | 6.0 Base
Cisco Unified MeetingPlace Express
1.1 Base | 1.2 Base | 2.0 Base
2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base | 2.4 Base | 2.46 Base | 3.0 .1, Base | 3.1 .2, .3, .5, .6, Base | 3.2 Base | 3.3 Base | 4.0 .1, .2, .3, .3b, .4, .5, Base | 4.1 .1, Base | 4.2 .1, .1 ES27, Base | 5.0 (1) | 7.0 (2) | Original Release Base
Cisco Unity Express
1.0.2 Base | 1.1.1 Base | 1.1.2 Base | 2.0.1 Base | 2.0.2 Base | 2.1.1 Base | 2.1.2 Base | 2.1.3 Base | 2.2.0 Base | 2.2.1 Base | 2.2.2 Base | 2.3.0 Base | 2.3.1 Base
Cisco Wireless Control System (WCS) Software
1.0 Base | 2.0 44.14, 44.24, Base | 2.2 .0, .111.0 | 3.0 .101.0 , .105.0, Base | 3.1 .20.0, .33.0, .35.0, Base | 3.2 .23.0, .25.0, .40.0, .51.0, .64.0, Base | 4.0 .1.0, .43.0, .66.0, .81.0, .87.0, .96.0, .97.0, Base | 4.1 .83.0, Base
CiscoWorks IP Telephony Environment Monitor (ITEM)
1.3 Base | 1.4 Base | 2.0 Base
CiscoWorks LAN Management Solution (LMS)
1.3 Base | 2.2 Base | 2.5 Base | 2.6 Base
CiscoWorks QoS Policy Manager (QPM)
2.0 .1, .2, .3, Base | 2.1 .2 | 3.0 .1, Base | 3.1 Base | 3.2 .1, .2, .3, Base
CiscoWorks Routed WAN Management Solution (RWAN)
1.0 Base | 1.1 Base | 1.2 Base | 1.3 .1, Base
CiscoWorks Small Network Management Solution (SNMS
1.0 Base | 1.5 Base
CiscoWorks VPN/Security Management Solution (VMS)
1.0 Base | 2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.