Cisco Response to Microsoft Security Bulletin for June 2007

June 12, 2007

Microsoft released the June Security Update on June 12, 2007. Six bulletins were released that address 15 individual vulnerabilities. Microsoft rated five vulnerabilities in Internet Explorer and one in Windows Mail for Microsoft Windows Vista as Critical. These vulnerabilities may allow an attacker to execute arbitrary code. Microsoft has also released updates for two common Windows APIs, Schannel and Win32, that also allow for code execution. However, in each instance, attackers rely on user interaction, and no exploit code exists publicly. These factors reduce the potential for exploitation. Lower impact vulnerabilities, rated Moderate and Important, exist in Microsoft Visio, Outlook Express, and Windows Mail.


Cisco Applied Mitigation Bulletin

The Applied Mitigation Bulletin provides identification and mitigation techniques that administrators can deploy on Cisco network devices. When applicable, Cisco IOS access control lists, Cisco Intrusion Prevention System (IPS) signatures, Control Plane Policing, and firewall rules are among the techniques discussed in the bulletin.

Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for June 2007


Cisco Security IntelliShield Alert Manager and Cisco IPS

The following table identifies Cisco Security IntelliShield Alert Manager alerts and Cisco Intrusion Prevention System (IPS) signatures associated with this Microsoft update:

Microsoft Security Bulletin Affected Product Cisco IntelliShield Alert CVE ID
Search CVEs
Cisco IPS Signature CVSS
Base Score
CVSS Q&A

Microsoft Security Bulletin MS07-030

Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution

Microsoft Visio

Microsoft Office

Microsoft Visio Version Number Field Memory Corruption Vulnerability CVE-2007-0934
8.0
Microsoft Visio Document Packaging Vulnerability CVE-2007-0936
8.0

Microsoft Security Bulletin MS07-031

Vulnerability in the Windows Schannel Security Package Could Allow Remote Code Execution

Microsoft Windows

Microsoft Windows XP

Microsoft Windows Server

Microsoft Windows Schannel Security Package Digital Signatures Handling Vulnerability CVE-2007-2218
8.0

Microsoft Security Bulletin MS07-032

Vulnerability in Windows Vista Could Allow Information Disclosure

Microsoft Windows Vista Microsoft Vista User Information Store Permissive ACLs Information Disclosure Vulnerability CVE-2007-2229
1.9

Microsoft Security Bulletin MS07-033

Cumulative Security Update for Internet Explorer

Microsoft Windows

Microsoft Windows XP

Microsoft Windows Server

Microsoft Windows Vista

Microsoft Internet Explorer

Microsoft Internet Explorer urlmon.dll COM Object Instantiation Memory Corruption Vulnerability CVE-2007-0218
5871.0
8.0
Microsoft Internet Explorer navcancl.htm Resource Page Cross-Site Scripting Vulnerability CVE-2007-1499
5868.0
1.9
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability CVE-2007-1751
8.0
Microsoft Internet Explorer Cascading Style Sheets Memory Corruption Vulnerability CVE-2007-1750
5869.0
8.0
Microsoft Internet Explorer Language Pack Installation Code Execution Vulnerability CVE-2007-3027
8.0
Microsoft Internet Explorer Speech Control COM Object Instantiation Vulnerability CVE-2007-2222
5873.0
5874.0
8.0

Microsoft Security Bulletin MS07-034

Cumulative Security Update for Outlook Express and Windows Mail

Microsoft Windows

Microsoft Windows XP

Microsoft Windows Server

Microsoft Windows Vista

Microsoft Internet Explorer

Microsoft Outlook Express

Microsoft Windows Mail in Windows Vista

Microsoft Windows Vista Windows Mail UNC Navigation Request Handling Code Execution Vulnerability CVE-2007-1658
8.0
Microsoft Internet Explorer MHTML Redirector Cross-Site Scripting Vulnerability CVE-2006-2111
5775.1
1.9
Microsoft Outlook Express and Windows Mail MHTML Prefix Handling Script Execution Vulnerability CVE-2007-2227
1.9
Microsoft Outlook Express URL Redirect in MHTML Handler Cross-Site Scripting Vulnerability CVE-2007-2225
1.9

Microsoft Security Bulletin MS07-035

Vulnerability in Win 32 API Could Allow Remote Code Execution

Microsoft Windows

Microsoft Windows XP

Microsoft Windows Server

Microsoft Windows Win32 API Parameter Validation Vulnerability CVE-2007-2219
5870.0
8.0

 

Return to Cisco Security Center