Microsoft Active Protection Program Advisories

The Microsoft Active Protections Program (MAPP) is a program for security software providers that provides Enterasys with security vulnerability information from the Microsoft Security Response Center (MSRC) in advance of Microsoft's monthly security updates. Microsoft may release additional security advisories for vulnerabilities actively being exploited which requires additional protections from Enterasys.

Latest Advisory

(2847140) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Microsoft has released an advisory (2847140) which addresses a zero-day vulnerability in the Microsoft Internet Explorer. There is currently no patch available for this vulnerability. Microsoft is actively working with MAPP partners to provide protections against attacks exploiting this vulnerability until a patch is ready to be released

The following signature(s) provide protection against this vulnerability:
IE:OBJECT-ACCESS-DELETE
WEB:BASE64-EVAL-SUSPICIOUS
WEB:BASE64-SUSPICIOUS

References:

Microsoft Security Advisory 2847140
CVE-2013-1347

All Advisories

(2794220) Vulnerability in Internet Explorer Could Allow Remote Code Execution

Microsoft has released an advisory (2974220) which addresses a zero-day vulnerability in the Microsoft Internet Explorer. There is currently no patch available for this vulnerability. Microsoft is actively working with MAPP partners to provide protections against attacks exploiting this vulnerability until a patch is ready to be released

The following signature(s) provide protection against this vulnerability:
IE:OBJECT-USE-AFTER-FREE
References:

Microsoft Security Advisory 2719615
CVE-2012-4792

(2719615) Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution

Microsoft has released an advisory (2719615) which addresses a zero-day vulnerability in the Microsoft XML Core Services. There is currently no patch available for this vulnerability. Microsoft is actively working with MAPP partners to provide protections against attacks exploiting this vulnerability until a patch is ready to be released.

The following signature(s) provide protection against this vulnerability:

IE:AX-MS-XMLCORE
IE:AX-MS-XMLCORE2
IE:AX-MS-XMLCORE3
IE:AX-MS-XMLCORE4
IE:AX-MS-XMLCORE5
IE:AX-MS-XMLCORE6
IE:AX-MS-XMLCORE7
IE:AX-MS-XMLCORE8
IE:AX-MS-XMLCORE9
IE:AX-MS-XMLCORE10

References:

Microsoft Security Advisory 2719615
CVE-2012-1889

(2639658) Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege

Microsoft has released an advisory (2639658) which addresses a zero-day vulnerability in Microsoft Windows. There is currently no patch available for this vulnerability. Microsoft is actively working with MAPP partners to provide protections against attacks exploiting this vulnerability until a patch is ready to be released.

The following signature(s) provide protection against this vulnerability:

MS:TTF-PRIVILEGE-ESCALATION

References:

Microsoft Security Advisory 2639658
W32.Dugu - The precursor to the next Stuxnet
CVE-2011-3402