The table below lists the Microsoft vulnerabilities for December 2008.

MS Bulletin Number	Microsoft Bulletin Title	Severity	Impact of Vulnerability	Affected Software	CVE ID
MS08-070	Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) Could Allow Remote Code Execution (932349)	Critical	Remote Code Execution	Microsoft Developer Tools and Software, Microsoft Office	CVE-2008-3704 CVE-2008-4252 CVE-2008-4253 CVE-2008-4254 CVE-2008-4255 CVE-2008-4256
MS08-071	Vulnerabilities in GDI Could Allow Remote Code Execution (956802)	Critical	Remote Code Execution	Microsoft Windows	CVE-2008-2249 CVE-2008-3465
MS08-072	Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (957173)	Critical	Remote Code Execution	Microsoft Office	CVE-2008-4024 CVE-2008-4025 CVE-2008-4026 CVE-2008-4027 CVE-2008-4028 CVE-2008-4030 CVE-2008-4031 CVE-2008-4837
MS08-073	Cumulative Security Update for Internet Explorer (958215)	Critical	Remote Code Execution	Microsoft Windows, Internet Explorer	CVE-2008-4258 CVE-2008-4259 CVE-2008-4260 CVE-2008-4261
MS08-074	Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (959070)	Critical	Remote Code Execution	Microsoft Office	CVE-2008-4264 CVE-2008-4265 CVE-2008-4266
MS08-075	Vulnerabilities in Windows Search Could Allow Remote Code Execution (959349)	Critical	Remote Code Execution	Microsoft Windows	CVE-2008-4268 CVE-2008-4269
MS08-076	Vulnerabilities in Windows Media Components Could Allow Remote Code Execution (959807)	Important	Remote Code Execution	Microsoft Windows	CVE-2008-3009 CVE-2008-3010
MS08-077	Vulnerability in Microsoft Office SharePoint Server Could Cause Elevation of Privilege (957175)	Important	Elevation of Privilege	Microsoft Office, Microsoft Server Software	CVE-2008-4032

Threat Remediation

Fortinet provides coverage on Microsoft vulnerabilities in March 2009.

CVE Number	Signature Name
CVE-2008-2249	MS.GDI.WMF.META.DIBBITBLT.Heap.Overflow
CVE-2008-3010	under analysis.
CVE-2008-3704	MS.Visual.Studio.Msmask32.ActiveX.Control.Access
CVE-2008-4024	MS.Word.PlfLfo.Memory.Corruption
CVE-2008-4025	MS.Word.RTF.Parsing.Code.Execution
CVE-2008-4026	MS.Word.Malformed.Value.Memory.Corruption
CVE-2008-4027	MS.Word.Malformed.RTF.Parsing.Code.Execution
CVE-2008-4028	MS.Word.RTF.Drawing.Parsing.Code.Execution
CVE-2008-4030	MS.Word.RTF.Dpgroup.Parsing.Code.Execution
CVE-2008-4031	MS.Word.RTF.Stylesheet.Parsing.Code.Execution
CVE-2008-4032	MS.Office.Sharepoint.Server.Privilege.Elevation
CVE-2008-4252	MS.Visual.Basic.DataGrid.ActiveX.Control.Access
CVE-2008-4253	MS.Visual.Basic.FlexGrid.ActiveX.Control.Access
CVE-2008-4254	MS.Visual.Basic.Hierarchical.FlexGrid.ActiveX.Control.Access
CVE-2008-4255	MS.Common.Controls.Animation.Object.Access
CVE-2008-4256	MS.Visual.Basic.Charts.ActiveX.Control.Access
CVE-2008-4258	MS.IE.ActiveX.Navigate.Method.Access
CVE-2008-4259	MS.IE.WebDav.Pathname.Parsing.Memory.Corruption
CVE-2008-4260	MS.IE7.Uninitialized.Memory.Corruption
CVE-2008-4261	MS.IE.HTML.Embed.Objects.Handle.Buffer.Overflow
CVE-2008-4264	MS.Excel.Obj.Record.Code.Execution
CVE-2008-4265	MS.Excel.Missing.MSO.Drawing.Group.Stack.Overrun
CVE-2008-4266	MS.Excel.Index.Value.Memory.Corruption
CVE-2008-4269	MS.Windows.Explorer.Code.Execution
CVE-2008-4837	MS.Word.Malformed.Record.Memory.Corruption

For more information on new and enhanced signatures, visit the IPS Service Update History. If you require more information, contact the FortiGuard Team using our Contact Us web page.

Document History

Revision Date	Version Number
Tuesday, December 9, 2008	1	Initial Documentation.
Friday, December 12, 2008	2	Signatures have been released on IPS Definition 2.577 previously in beta state.
Monday, December 15, 2008	2	Signature for CVE-2008-4027 has been released on IPS Definition 2.578 previously in beta state.

Reference:

• Microsoft Security Bulletin Summary for December 2008: http://www.microsoft.com/technet/security/bulletin/ms08-dec.mspx