# MA-362.112013: MyCERT Alert - Microsoft Security Bulletin Summary For November 2013

**Date:** 14 Nov 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-362.112013  
**Advisory ID:** MA-362.112013

---

**1.0 Introduction**
Microsoft had released the November Security Bulletins–three Critical and five Important–which addressed unique CVEs in Microsoft Windows, Office and Internet Explorer. These vulnerabilities could allow remote code execution, elevation of privilege, information disclosure or denial of service. With the release of the security bulletins for November 2013, this bulletin summary replaces the bulletin advance notification originally issued in November 7, 2013 by Microsoft.
**2.0 The list of the critical vulnerabilities are as below:**
> **2.1 Cumulative Security Update for Internet Explorer (2888505)**
>
> This security update resolves ten privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-088>
>
> **2.2 Vulnerability in Windows Graphics Device Interface Could Allow Remote Code Execution (2876331)**
>
> This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views or opens a specially crafted Windows Write file in WordPad. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-089>
>
> **2.3 Cumulative Security Update of ActiveX Kill Bits (2900986)**
>
> This security update resolves a privately reported vulnerability that is currently being exploited. The vulnerability exists in the InformationCardSigninHelper Class ActiveX control. The vulnerability could allow remote code execution if a user views a specially crafted webpage with Internet Explorer, instantiating the ActiveX control. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-090>
**3.0 The list of the Important vulnerabilities are as below:**
> **3.1 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2885093)**
>
> This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a specially crafted WordPerfect document file is opened in an affected version of Microsoft Office software. An attacker who successfully exploited the most severe vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-091>
>
> **3.2 Vulnerability in Hyper-V Could Allow Elevation of Privilege (2893986)**
>
> This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker passes a specially crafted function parameter in a hypercall from an existing running virtual machine to the hypervisor. The vulnerability could also allow denial of service for the Hyper-V host if the attacker passes a specially crafted function parameter in a hypercall from an existing running virtual machine to the hypervisor.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-092>
>
> **3.3  Vulnerability in Windows Ancillary Function Driver Could Allow Information Disclosure (2875783)**
>
> This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow information disclosure if an attacker logs on to an affected system as a local user, and runs a specially crafted application on the system that is designed to enable the attacker to obtain information from a higher-privileged account. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability..
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-093>
>
> 3**.4 Vulnerability in Microsoft Outlook Could Allow Information Disclosure (2894514)**
>
> This security update resolves a publicly disclosed vulnerability in Microsoft Outlook. The vulnerability could allow information disclosure if a user opens or previews a specially crafted email message using an affected edition of Microsoft Outlook. An attacker who successfully exploited this vulnerability could ascertain system information, such as the IP address and open TCP ports, from the target system and other systems that share the network with the target system.
>
> Patch: <http://technet.microsoft.com/en-us/security/bulletin/ms13-094>
>
> **3.4 Vulnerability in Digital Signatures Could Allow Denial of Service (2868626)**
>
> This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service when an affected web service processes a specially crafted X.509 certificate.
>
> Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms13-095>
**4.0 Recommendation**
Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#3a5943585f480303037a5943585f48495f594f48534e43145743) or [[email protected]](/cdn-cgi/l/email-protection#5f32263c3a2d2b1f32263c3a2d2b71302d38713226)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://technet.microsoft.com/en-us/security/bulletin/ms13-nov>
- <http://krebsonsecurity.com/2013/11/zero-days-rule-novembers-patch-tuesday/>
- <http://www.us-cert.gov/ncas/current-activity/2013/11/12/Microsoft-Addresses-New-Watering-Hole-Attack-November-2013-Security>