Microsoft security alert.
November 8, 2016
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 76 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Security Update for SQL Server (MS16-136)
- Severity
- Critical 4
- Qualys ID
- 91304
- Vendor Reference
- MS16-136
- CVE Reference
- CVE-2016-7249, CVE-2016-7250, CVE-2016-7251, CVE-2016-7252, CVE-2016-7253, CVE-2016-7254
- CVSS Scores
- Base 6.5 / Temporal 4.8
- Description
- This security update resolves vulnerabilities in Microsoft SQL Server. The security update addresses these most severe vulnerabilities by correcting how SQL Server handles pointer casting. This security update is rated Important for supported editions of Microsoft SQL Server 2012 Service Packs 2 and 3, Microsoft SQL Server 2014 Service Packs 1 and 2, and Microsoft SQL Server 2016.
- Consequence
- Successful exploitation could allow an attacker could to gain elevated privileges that could be used to view, change, or delete data; or create new accounts.
- Solution
-
Customers are advised to refer to MS16-136 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-136 Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2
MS16-136 Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3
MS16-136 Microsoft SQL Server 2012 for x64-based Systems Service Pack 2
MS16-136 Microsoft SQL Server 2012 for x64-based Systems Service Pack 3
MS16-136 Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems
MS16-136 Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems
MS16-136 Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems
MS16-136 Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems
MS16-136 Microsoft SQL Server 2016 for x64-based Systems
-
Microsoft Edge Cumulative Security Update (MS16-129)
- Severity
- Urgent 5
- Qualys ID
- 91300
- Vendor Reference
- MS16-129
- CVE Reference
- CVE-2016-7195, CVE-2016-7196, CVE-2016-7198, CVE-2016-7199, CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7204, CVE-2016-7208, CVE-2016-7209, CVE-2016-7227, CVE-2016-7239, CVE-2016-7240, CVE-2016-7241, CVE-2016-7242, CVE-2016-7243
- CVSS Scores
- Base 7.6 / Temporal 6.6
- Description
-
This security update is rated Critical for Microsoft Edge on Windows 10.
The update patches the vulnerabilities by:
modifying how Microsoft browsers handles objects in memory.
modifying how the Chakra JavaScript scripting engine handles objects in memory.
changing how the XSS filter in Microsoft browsers handle RegEx.
correcting how the Microsoft Edge parses HTTP responses. - Consequence
-
The most severe of the vulnerabilities could allow attacker to perform remote code execution, by corrupting browser memory, by corrupting the scripting engine memory. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.
- Solution
-
Customers are advised to refer to Microsoft Security Bulletin MS16-129 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-129 Windows 10 Version 1511 for 32-bit Systems
MS16-129 Windows 10 Version 1511 for x64-based Systems
MS16-129 Windows 10 Version 1607 for 32-bit Systems
MS16-129 Windows 10 Version 1607 for x64-based Systems
MS16-129 Windows 10 for 32-bit Systems
MS16-129 Windows 10 for x64-based Systems
MS16-129 Windows Server 2016 for x64-based Systems
-
Microsoft IME Elevation of Privilege Vulnerability (MS16-130)
- Severity
- Critical 4
- Qualys ID
- 91302
- Vendor Reference
- MS16-130
- CVE Reference
- CVE-2016-7212, CVE-2016-7221, CVE-2016-7222
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
This security update resolves elevation of privilege vulnerabilities in Microsoft Windows Input Method Editor (IME) and the Windows Task Scheduler. This security update is rated Critical for all supported releases of Microsoft Windows. The security update addresses the vulnerabilities by:
Correcting how the Windows Input Method Editor (IME) loads DLLs.
Requiring hardened UNC paths be used in scheduled tasks. - Consequence
- An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges.
- Solution
-
Customers are advised to refer to Microsoft Security Bulletin MS16-130 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-130
-
Microsoft Video Control Remote Code Execution Vulnerability (MS16-131)
- Severity
- Urgent 5
- Qualys ID
- 91297
- Vendor Reference
- MS16-131
- CVE Reference
- CVE-2016-7248
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
A remote code execution vulnerability exists when Microsoft Video Control fails to properly handle objects in memory.
This security update is rated Critical for Microsoft Windows Vista, Windows 7, Windows 8.1, Windows RT 8.1, Windows 10, and Windows Server 2016.
- Consequence
- Successful exploitation allows attacker to run arbitrary code in the context of the current user.
- Solution
- Customers are advised to refer to MS16-131 for more information.
-
Microsoft Windows Graphics Component Multiple Vulnerabilities (MS16-132)
- Severity
- Urgent 5
- Qualys ID
- 91301
- Vendor Reference
- MS16-132
- CVE Reference
- CVE-2016-7205, CVE-2016-7210, CVE-2016-7217, CVE-2016-7256
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
Microsoft Windows Graphics Component is prone to multiple vulnerabilities that could lead to information disclosure or remote code execution attacks.
An information disclosure vulnerability exists when the ATMFD component improperly discloses the contents of its memory.
A remote code execution vulnerability exists when the Windows Animation Manager improperly handles objects in memory.
A memory corruption vulnerability exists when the Windows Media Foundation improperly handles objects in memory.
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts.
This security update is rated Critical for all supported releases of Microsoft Windows.
- Consequence
- Successful exploitation allows attacker to execute arbitrary code.
- Solution
-
Refer to MS16-132 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-132
-
Microsoft Office Remote Code Execution Vulnerabilities (MS16-133)
- Severity
- Urgent 5
- Qualys ID
- 110290
- Vendor Reference
- MS16-133
- CVE Reference
- CVE-2016-7213, CVE-2016-7228, CVE-2016-7229, CVE-2016-7230, CVE-2016-7231, CVE-2016-7232, CVE-2016-7233, CVE-2016-7234, CVE-2016-7235, CVE-2016-7236, CVE-2016-7244, CVE-2016-7245
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
This security update resolves vulnerabilities in Microsoft Office.
The security update addresses the vulnerabilities by correcting how Microsoft Office initializes variables.
Affected versions of Office and Office components handle objects in memory.
- Consequence
- The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.
- Solution
-
Refer to MS16-133 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-133 Excel Services on Microsoft SharePoint Server 2010 Service Pack 2
MS16-133 Microsoft Excel 2007 Service Pack 3
MS16-133 Microsoft Excel 2010 Service Pack 2 (32-bit editions)
MS16-133 Microsoft Excel 2010 Service Pack 2 (64-bit editions)
MS16-133 Microsoft Excel 2013 Service Pack 1 (32-bit editions)
MS16-133 Microsoft Excel 2013 Service Pack 1 (64-bit editions)
MS16-133 Microsoft Excel 2016 (32-bit edition)
MS16-133 Microsoft Excel 2016 (64-bit edition)
MS16-133 Microsoft Excel 2016 for Mac
MS16-133 Microsoft Excel 2016 for Mac
MS16-133 Microsoft Excel Viewer
MS16-133 Microsoft Excel for Mac 2011
MS16-133 Microsoft Office 2007 Service Pack 3
MS16-133 Microsoft Office 2007 Service Pack 3
MS16-133 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS16-133 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS16-133 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS16-133 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS16-133 Microsoft Office 2013 Service Pack 1 (32-bit editions)
MS16-133 Microsoft Office 2013 Service Pack 1 (64-bit editions)
MS16-133 Microsoft Office 2016 (32-bit edition)
MS16-133 Microsoft Office 2016 (64-bit edition)
MS16-133 Microsoft Office Compatibility Pack Service Pack 3
MS16-133 Microsoft Office Compatibility Pack Service Pack 3
MS16-133 Microsoft Office Web Apps 2010 Service Pack 2
MS16-133 Microsoft Office Web Apps Server 2013 Service Pack 1
MS16-133 Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
MS16-133 Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
MS16-133 Microsoft PowerPoint Viewer
MS16-133 Microsoft Word 2007
MS16-133 Microsoft Word 2010 Service Pack 2 (32-bit editions)
MS16-133 Microsoft Word 2010 Service Pack 2 (64-bit editions)
MS16-133 Microsoft Word 2013 Service Pack 1 (32-bit editions)
MS16-133 Microsoft Word 2013 Service Pack 1 (64-bit editions)
MS16-133 Microsoft Word 2016 for Mac
MS16-133 Microsoft Word Viewer
MS16-133 Microsoft Word for Mac 2011
MS16-133 Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
MS16-133 Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1
-
Microsoft Windows Common Log File System Driver Elevation of Privilege Vulnerability (MS16-134)
- Severity
- Critical 4
- Qualys ID
- 91299
- Vendor Reference
- MS16-134
- CVE Reference
- CVE-2016-0026, CVE-2016-3332, CVE-2016-3333, CVE-2016-3334, CVE-2016-3335, CVE-2016-3338, CVE-2016-3340, CVE-2016-3342, CVE-2016-3343, CVE-2016-7184
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
This security update resolves vulnerabilities in Microsoft Windows.
The security update addresses the vulnerabilities by correcting how CLFS handles objects in memory
Elevation of privilege vulnerabilities exist when the Windows Common Log File System (CLFS) driver improperly handles objects in memory.
This security update is rated Important for all supported releases of Microsoft Windows. - Consequence
- The vulnerability could allow elevation of privilege when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploits this vulnerability could run processes in an elevated context.To exploit the vulnerabilities, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.
- Solution
-
Refer to Microsoft Security Bulletin MS16-134 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-134
-
Microsoft Security Update for Windows Kernel-Mode Drivers (MS16-135)
- Severity
- Critical 4
- Qualys ID
- 91294
- Vendor Reference
- MS16-135, Microsoft-STRONTIUM
- CVE Reference
- CVE-2016-7214, CVE-2016-7215, CVE-2016-7218, CVE-2016-7246, CVE-2016-7255
- CVSS Scores
- Base 7.2 / Temporal 6.3
- Description
-
This security update resolves multiple vulnerabilities in Microsoft Windows.
- An Information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. (CVE-2016-7214)
- Multiple elevation of privilege vulnerabilities exists when the Windows kernel-mode driver fails to properly handle objects in memory. (CVE-2016-7215, CVE-2016-7246, CVE-2016-7255)
- An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in memory. (CVE-2016-7218)This security update is rated Important for Microsoft Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (and Server Core), Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10 and Windows Server 2016.
Google Security and Microsoft Threat Intelligence reports that this critical vulnerability is actively being exploited in the wild.
Further details can be found under Disclosing vulnerabilities to protect users .
Microsoft statement can be found under Nov 1, 2016: Our commitment to our customer's security. - Consequence
-
Could allow an attacker to gain unauthorized higher privileges with system-level privileges and take control of an affected system.
- Solution
-
Customers are advised to refer to MS16-135 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-135 Windows 10
MS16-135 Windows 10 Version 1511
MS16-135 Windows 10 Version 1511 x64
MS16-135 Windows 10 Version 1607
MS16-135 Windows 10 Version 1607 x64
MS16-135 Windows 10 x64
MS16-135 Windows 2008 R2 x64
MS16-135 Windows 7
MS16-135 Windows 7 x64
MS16-135 Windows 8.1
MS16-135 Windows 8.1 x64
MS16-135 Windows Server 2008
MS16-135 Windows Server 2008 x64
MS16-135 Windows Server 2012
MS16-135 Windows Server 2012 R2
MS16-135 Windows Server 2016 x64
MS16-135 Windows Vista
MS16-135 Windows Vista x64
-
Microsoft Windows Authentication Methods Multiple Vulnerabilities (MS16-137)
- Severity
- Critical 4
- Qualys ID
- 91298
- Vendor Reference
- MS16-137
- CVE Reference
- CVE-2016-7220, CVE-2016-7237, CVE-2016-7238
- CVSS Scores
- Base 7.2 / Temporal 6.3
- Description
-
This security update resolves vulnerabilities in Microsoft Windows.
The security update addresses the vulnerabilities by:
Updating Windows NTLM to harden the password change cache. This security update corrects a local elevation of privilege that exists when Windows fails to properly handle NTLM password change requests. (CVE-2016-7238)
Changing the way that LSASS handles specially crafted requests. This security update corrects a denial of service vulnerability in the Local Security Authority Subsystem Service (LSASS) caused when an attacker sends a specially crafted request. (CVE-2016-7237)
Correcting how Windows Virtual Secure Mode handles objects in memory. An information disclosure vulnerability exists when Windows Virtual Secure Mode improperly handles objects in memory. (CVE-2016-7220)This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- The more severe of the vulnerabilities could allow elevation of privilege. To exploit this vulnerability, the attacker would first need to authenticate to the target, domain-joined system using valid user credentials. An attacker who successfully exploited this vulnerability could elevate their permissions from unprivileged user account to administrator. The attacker could then install programs; view, change or delete data; or create new accounts. The attacker could subsequently attempt to elevate by locally executing a specially crafted application designed to manipulate NTLM password change requests.
- Solution
-
Refer to Microsoft Security Bulletin MS16-137 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-137
-
Microsoft Windows Security Update for Microsoft Virtual Hard Disk Driver (MS16-138)
- Severity
- Serious 3
- Qualys ID
- 91296
- Vendor Reference
- MS16-138
- CVE Reference
- CVE-2016-7223, CVE-2016-7224, CVE-2016-7225, CVE-2016-7226
- CVSS Scores
- Base 3.6 / Temporal 3
- Description
-
Multiple elevation of privilege vulnerabilities exist when the Windows Virtual Hard Disk Driver fails to properly handle user access to certain files.
The security update addresses the vulnerabilities by correcting how the kernel API restricts access to these files.
This security update is rated Important for of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.
- Consequence
- An attacker who successfully exploited the vulnerabilities could manipulate files in locations not intended to be available to the user.
- Solution
-
Customers are advised to view MS16-138 for instructions pertaining to the remediation of these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-138 Windows(Microsoft Virtual Hard Disk Driver)
-
Microsoft Windows Kernel Elevation of Privilege Vulnerability (MS16-139)
- Severity
- Urgent 5
- Qualys ID
- 91303
- Vendor Reference
- MS16-139
- CVE Reference
- CVE-2016-7216
- CVSS Scores
- Base 2.1 / Temporal 1.6
- Description
- An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. The security update addresses the vulnerability by helping to ensure that the Windows Kernel API properly enforces permissions. This security update is rated Important for Microsoft Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (and Server Core).
- Consequence
- An attacker who successfully exploited the vulnerability could gain access to information that is not intended for the user.
- Solution
-
Customers are advised to refer to MS16-139 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
/MS16-139
-
Microsoft Boot Manager Security Bypass Vulnerability (MS16-140)
- Severity
- Critical 4
- Qualys ID
- 91295
- Vendor Reference
- MS16-140
- CVE Reference
- CVE-2016-7247
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
This security update resolves a vulnerability in Microsoft Windows.
A security feature bypass vulnerability exists when Windows Secure Boot improperly loads a boot policy that is affected by the vulnerability.
The security update addresses the vulnerability by revoking affected boot policies in the firmware.Affected Versions:-
This security update is rated Important for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016. - Consequence
- An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded onto a target device. The vulnerability could allow security feature bypass if a physically-present attacker installs an affected boot policy.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS16-140 for more details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-140
-
Microsoft Windows Update for Vulnerabilities in Adobe Flash Player in Internet Explorer (MS16-141)
- Severity
- Urgent 5
- Qualys ID
- 100300
- Vendor Reference
- MS16-141
- CVE Reference
- CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864, CVE-2016-7865
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft released an update for Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.
The update addresses the vulnerabilities described in Adobe Security bulletin APSB16-37.
This security update is rated Critical for Adobe Flash Player in Internet Explorer 10, Internet Explorer 11 and Microsoft Edge.
- Consequence
- Successful exploitation of this vulnerability will allow an attacker to execute arbitrary code.
- Solution
-
Customers are advised to view MS16-141 for instructions pertaining to the remediation of these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-141(Adobe Flash Player in Internet Explorer)
-
Microsoft Cumulative Security Update for Internet Explorer (MS16-142)
- Severity
- Urgent 5
- Qualys ID
- 100301
- Vendor Reference
- MS16-142
- CVE Reference
- CVE-2016-7195, CVE-2016-7196, CVE-2016-7198, CVE-2016-7199, CVE-2016-7227, CVE-2016-7239, CVE-2016-7241
- CVSS Scores
- Base 7.6 / Temporal 6.6
- Description
-
Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.
Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Critical for affected Windows Client for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11) and Moderate on affected Windows Servers.
The security update addresses the vulnerabilities by fixing:
1. How Internet Explorer modifies objects in memory.
2. XSS filter to handle to Regex in Internet Explorer.
- Consequence
-
The most critical vulnerabilities would enable an attacker to perform remote code execution with the help of specially crafted webpages using Internet Explorer. Successful exploitation of the vulnerabilities will enable the attacker to gain same rights as the user. Users logged-in with administrative rights would allow the attacker to take control of the affected system and would allow the attacker to install programs; view, modify or delete data and create new user accounts with complete privileges.
- Solution
-
For more information, Customers are advised to refer the official advisory from Microsoft (MS16-142).
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-142 Windows 10 Version 1511 for 32-bit Systems
MS16-142 Windows 10 Version 1511 for x64-based Systems
MS16-142 Windows 10 Version 1607 for 32 bit Systems
MS16-142 Windows 10 Version 1607 for x64-based Systems
MS16-142 Windows 10 for 32-bit Systems
MS16-142 Windows 10 for x64-based Systems
MS16-142 Windows 7 for 32-bit Systems Service Pack 1Monthly Roll Up(Internet Explorer 11)
MS16-142 Windows 7 for 32-bit Systems Service Pack 1Security Only(Internet Explorer 11)
MS16-142 Windows 7 for x64-based Systems Service Pack 1Monthly Roll-Up(Internet Explorer 11)
MS16-142 Windows 7 for x64-based Systems Service Pack 1Security Only(Internet Explorer 11)
MS16-142 Windows 8.1 for 32-bit Systems Security Only(Internet Explorer 11)
MS16-142 Windows 8.1 for 32-bit SystemsMonthly Roll-Up(Internet Explorer 11)
MS16-142 Windows 8.1 for x64-based SystemsMonthly Roll-Up(Internet Explorer 11)
MS16-142 Windows 8.1 for x64-based SystemsSecurity Only(Internet Explorer 11)
MS16-142 Windows Server 2008 R2 for x64-based Systems Service Pack 1Monthly Roll-Up(Internet Explorer 11)
MS16-142 Windows Server 2008 R2 for x64-based Systems Service Pack 1Security Only(Internet Explorer 11)
MS16-142 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS16-142 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS16-142 Windows Server 2012 Monthly Roll-Up(Internet Explorer 10)
MS16-142 Windows Server 2012 Security Only(Internet Explorer 10)
MS16-142 Windows Server 2012 R2Monthly Roll-Up(Internet Explorer 11)
MS16-142 Windows Server 2012 R2Security Only(Internet Explorer 11)
MS16-142 Windows Vista Service Pack 2(Internet Explorer 9)
MS16-142 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
These new vulnerability checks are included in Qualys vulnerability signature 2.3.470-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 91304
- 91300
- 91302
- 91297
- 91301
- 110290
- 91299
- 91294
- 91298
- 91296
- 91303
- 91295
- 100300
- 100301
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.