•  A previously public (Dec 8, 2010) remote code-execution vulnerability affects Internet Explorer when parsing Cascading Style Sheet (CSS) expressions.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

Sig ID: 24026
Detected as "HTTP MSIE CSS File Memory Corruption"

 Microsoft Internet Explorer CVE-2011-0035 Uninitialized Memory Remote Code Execution Vulnerability
Remote Code Execution Vulnerability

•  A remote code-execution vulnerability affects Internet Explorer due to how it handles an object that has not been properly initialized, or has been deleted.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

 Microsoft Internet Explorer CVE-2011-0036 Uninitialized Memory Remote Code Execution Vulnerability
Remote Code Execution Vulnerability

•  A remote code-execution vulnerability affects Internet Explorer due to how it handles an object that has not been properly initialized, or has been deleted.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A previously public (Jan 4, 2011) remote-code execution vulnerability affects the Windows Shell graphics processor.
• The problem occurs in the 'CreateSizedDIBSECTION()' function of the 'shimgvw.dll' file when handling malformed thumbnails. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a malicious thumbnail image.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

AV:Bloodhound.Exploit.384
Sygate IDS: N/A
Symantec Critical System Protection IPS:Generic Windows Interactive Protection

• A remote code-execution vulnerability affects the OpenType Compact Font Format (CFF) driver.
• An attacker can exploit this issue by hosting a specially malformed OpenType font on a remote share and tricking an unsuspecting victim into navigating to it.
• When the font is processed, attacker-supplied code will execute in the context of the currently logged-in user.

•  A previously public (Nov. 24, 2010) privilege-escalation vulnerability affects the 'RtlQueryRegistryValues()' API function of Microsoft Windows.
• A local attacker can exploit this issue to bypass User Access Control (UAC) protections and gain complete control of an affected computer.

•  A local privilege-escalation vulnerability affects Microsoft Windows due to how it allocates memory when handling user-supplied data.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete compromise of the affected computer.

• A remote code-execution vulnerability affects Visio.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted Visio file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

• A remote code-execution vulnerability affects Visio when parsing certain structures.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening a specially crafted Visio file.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

 Microsoft VBScript and JScript Scripting Engines CVE-2011-0031 Information Disclosure Vulnerability 
Information Disclosure Vulnerability

• A remote information-disclosure vulnerability affects the JScript and VBScript scripting engines due to a memory corruption error.
• An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content.
• A successful exploit may result in the disclosure of potentially sensitive information. Information obtained may aid in further attacks.

AV: Bloodhound.Exploit.387
Sygate IDS: N/A
Symantec Critical System Protection IPS: Generic Windows Interactive Protection

• A local privilege-escalation vulnerability affects the Client/Server Run-time Subsystem (CSRSS).
• An attacker can exploit this issue to deploy eavesdropping software to listen to subsequent logins and the interactions of those users. Information obtained may aid in further attacks.

• A denial-of-service vulnerability affects Active Directory when handling service principal (SPN) names.
• An attacker can exploit this issue by sending specially crafted packets to the affected server.
• A successful exploit may cause name collisions in the domain, or possible cause the affected server to become unresponsive.

• A local privilege-escalation vulnerability affects the Local Security Subsystem Authentication Service (LSASS) when handling certain authentication requests.
• A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges.
• This may facilitate complete compromise of the affected computer.

• A local privilege-escalation vulnerability affects Windows kernel-mode drivers when validating data supplied from user-mode to kernel-mode.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges. This may facilitate a complete compromise of the affected computer.

•  A local privilege-escalation vulnerability affects Windows kernel-mode drivers when validating data supplied from user-mode to kernel-mode.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete compromise of the affected computer.

•  A local privilege-escalation vulnerability affects Windows kernel-mode drivers when validating data supplied from user-mode to kernel-mode.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete compromise of the affected computer

• A local privilege-escalation vulnerability affects Windows kernel-mode drivers when validating data supplied from user-mode to kernel-mode.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete compromise of the affected computer.

CAN/CVE ID: CVE-2011-0090
BID: 46150
Microsoft ID: MS11-012
MSKB: 2479628
Microsoft Rating: Important

Microsoft Windows Kernel 'Win32k.sys' (CVE-2011-0090) Local Privilege Escalation
Local Escalation of Privilege Vulnerability

• A local privilege-escalation vulnerability affects Windows kernel-mode drivers when validating data supplied from user-mode to kernel-mode.
• A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges.
• This may facilitate a complete compromise of the affected computer.

• A previously public (Dec 21, 2010) buffer-overflow vulnerability affects the Internet Information Service FTP service.
• The problem occurs in the 'TELNET_STREAM_CONTEXT::OnSendData()' function of the 'ftpsvc.dll' library when processing certain FTP commands.
• A remote attacker can exploit this issue to execute arbitrary code in the context of the affected application.

• A remote spoofing vulnerability affects the Microsoft Windows implementation of Kerberos because it does not properly enforce a stronger encryption standard.
• A man-in-the-middle attacker can potentially exploit this issue to downgrade the encryption on traffic, enabling them to read it.
• Information obtained may aid in further attacks.

AV: N/A
Sygate IDS: N/A
Symantec Critical System Protection IPS: N/A

• A remote spoofing vulnerability affects the Microsoft Windows implementation of Kerberos because it does not properly enforce a stronger encryption standard.
• A man-in-the-middle attacker can potentially exploit this issue to downgrade the encryption on traffic, enabling them to read it. Information obtained may aid in further attacks.

Microsoft Internet Explorer DLL Loading Arbitrary Code Execution Vulnerability
  Remote Code Execution Vulnerability

• A remote code-execution vulnerability affects Internet Explorer due to how it loads DLL files.
• An attacker can exploit this issue by tricking an unsuspecting victim into opening an HTML file from a remote WebDAV or SMB share.
• A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.

AV: Under review
Sygate IDS: N/A
Symantec Critical System Protection IPS: Generic Windows Interactive Protection