2. To receive our video stream in LiveMeeting: - Click on “Voice & Video” - Click the drop down next to the camera icon - Select “Show Main Video” Dial-in Information: - 1 (877) 593-2001 Pin: 3959

3. Review of September 2013 Bulletin Release Information - 13 New Security Bulletins - One Updated Security Advisory - Microsoft Windows Malicious Software Removal Tool Resources Questions and Answers: Please Submit Now - Submit Questions via Twitter #MSFTSecWebcast

4. Severity & Exploitability Index Exploitability Index 1 RISK 2 3 DP1112322332332 Severity Critical IMPACT Important Moderate Low MS13- 067 MS13- 068 MS13- 069 MS13- 070 MS13- 071 MS13- 072 MS13- 073 MS13- 074 MS13- 075 MS13- 076 MS13- 077 MS13- 078 MS13- 079 Internet Explorer Outlook SharePoint Server OLE Active Directory Excel Office Kernel-Mode Driver Office IME (Chinese) Windows SCM FrontPage Windows Theme File Access

5. Bulletin Deployment Priority

6. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-1330CriticalNA1Remote Code ExecutionCooperatively Disclosed CVE-2013-3847ImportantNA1Remote Code ExecutionCooperatively Disclosed CVE-2013-3848 CVE-2013-3857 CVE-2013-3858 ImportantNA2Remote Code ExecutionCooperatively Disclosed CVE-2013-1315 CVE-2013-3849 ImportantNA3Remote Code ExecutionCooperatively Disclosed CVE-2013-3180Important33Elevation of PrivilegePublicly Disclosed CVE-2013-3179Important33Elevation of PrivilegeCooperatively Disclosed CVE-2013-0081Important33Denial of ServiceCooperatively Disclosed Affected Products All supported editions of Microsoft SharePoint Server 2007, Microsoft SharePoint Server 2010, Microsoft SharePoint Server 2013, Microsoft SharePoint Services 2.0, Microsoft SharePoint Services 3.0, and Microsoft SharePoint Foundation 2010. Affected Microsoft Office Services and Web Apps on supported editions of Microsoft SharePoint Server 2010. Excel Services on Microsoft SharePoint Server 2007 Affected ComponentsMicrosoft Office Server Software Deployment Priority1 Main TargetServers Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted Office file to the user and then convince the user to open the file. (CVE-2013-1315, CVE-2013-3847, CVE-2013-3848, CVE-2013-3849, CVE-2013-3857, CVE-2013-3858) In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Office file that is used to attempt to exploit this vulnerability. (CVE-2013-1315, CVE-2013-3847, CVE-2013-3848, CVE- 2013-3849, CVE-2013-3857, CVE-2013-3858) MS13-067: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2834052)

7. Possible Attack Vectors, cont. The attacker could take advantage of compromised websites and websites that accept or host user-provided content. (CVE-2013-1315, CVE-2013-3847, CVE-2013-3848, CVE-2013-3849, CVE-2013-3857, CVE-2013- 3858) An attacker must enter a specially crafted URL to a system running an affected version of SharePoint Server. (CVE-2013-0081) In an attack scenario, the attacker could send specially crafted content to the target server. (CVE-2013-1330) An authenticated attacker could send a specially crafted request to an affected SharePoint server. (CVE-2013- 3179) An authenticated attacker could submit a specially crafted POST request to a SharePoint server. (CVE-2013- 3180) Impact of Attack An attacker could run arbitrary code in the context of the current user. (CVE-2013-1315, CVE-2013-3847, CVE- 2013-3848, CVE-2013-3849, CVE-2013-3857, CVE-2013-3858) An attacker could cause the W3WP process on an affected version of SharePoint Server to terminate, causing the SharePoint site, and any other sites running under that process, to become unavailable until the process is restarted. (CVE-2013-0081) An attacker could run arbitrary code in the context of the W3WP service account. (CVE-2013-1330) An attacker could read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim. (CVE-2013-3179, CVE-2013-3180) Mitigating Factors An attacker cannot force users to view the attacker-controlled content. (CVE-2013-1315, CVE-2013-3847, CVE- 2013-3848, CVE-2013-3849, CVE-2013-3857, CVE-2013-3858) Microsoft has not identified any mitigating factors for this vulnerability. (CVE-2013-0081, CVE-2013-1330, CVE- 2013-3179, CVE-2013-3180) The vulnerabilities cannot be exploited automatically through email. For an attack to be successful a user must open an attachment that is sent in an email message. (CVE-2013-3847, CVE-2013-3848, CVE-2013-3849, CVE- 2013-3857, CVE-2013-3858) Additional Information In addition to the changes that are listed in the Vulnerability Information section of this bulletin, the 2553219 update for Visio Services includes defense-in-depth updates that address the vulnerability referenced as CVE- 2013-3129. At the time of release there were no known attacks using vulnerability CVE-2013-3180. MS13-067: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2834052) continued….

8. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3870CriticalNA2Remote Code ExecutionCooperatively Disclosed Affected ProductsAll supported editions of Microsoft Outlook 2007 and Microsoft Outlook 2010 Affected ComponentsMicrosoft Outlook Deployment Priority1 Main TargetWorkstations Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted email message to the user and then convince the user to preview or open the email. Impact of AttackAn attacker could run arbitrary code as the logged-on user. Mitigating Factors Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. MS13-068: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2756473)

9. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3203 CVE-2013-3204 CVE-2013-3205 CVE-2013-3206 CVE-2013-3207 CVE-2013-3208 CVE-2013-3209 CVE-2013-3845 CriticalNA1Remote Code ExecutionCooperatively Disclosed CVE-2013-3201 CVE-2013-3202 CriticalNA2Remote Code ExecutionCooperatively Disclosed Affected Products IE6 – IE10 on all supported versions of Windows Client IE6 – IE10 on all supported versions of Windows Server Affected ComponentsInternet Explorer Deployment Priority1 Main TargetWorkstations Possible Attack Vectors An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. (All CVEs) The attacker could take advantage of compromised websites and websites that accept or host user- provided content or advertisements. (All CVEs) Impact of AttackAn attacker could gain the same user rights as the current user. (All CVEs) MS13-069: Cumulative Security Update for Internet Explorer (2870699)

10. Mitigating Factors An attacker cannot force users to view the attacker-controlled content. (All CVEs) By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML email messages in the Restricted sites zone. (All CVEs) By default, Internet Explorer on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012 runs in a restricted mode that is known as Enhanced Security Configuration. (All CVEs) Additional Information Internet Explorer 11 is considered the “Latest” version Installations using Server Core are not affected. The 2870699 update is available for Internet Explorer 11 Preview for Windows 7, Windows 8.1 Preview, and Windows RT 8.1 Preview. Customers with Internet Explorer 11 Preview are encouraged to apply the updates to their systems. The updates are available on Windows Update. MS13-069: Cumulative Security Update for Internet Explorer (2870699) continued….

11. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3863CriticalNA1Remote Code ExecutionCooperatively Disclosed Affected ProductsAll supported editions of Windows XP and Windows Server 2003 Affected ComponentsObject Linking and Embedding (OLE) Deployment Priority2 Main TargetWorkstations Possible Attack Vectors An attacker could send an email message to a locally logged-on user and then convince the user to open an attachment that contains a specially crafted OLE object. Impact of AttackAn attacker could run arbitrary code in the context of the current user. Mitigating Factors The vulnerability cannot be exploited automatically through email; a user must open an attachment that is sent in an email message. Additional InformationInstallations using Server Core are not affected. MS13-070: Vulnerability in OLE Could Allow Remote Code Execution (2876217)

12. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-0810ImportantNA1Remote Code ExecutionCooperatively Disclosed Affected ProductsAll supported editions of Windows XP and Windows Server 2003 Affected ComponentsWindows Theme File Deployment Priority3 Main TargetWorkstations Possible Attack Vectors An attacker could convince a user to open a maliciously crafted theme file containing a specially crafted screensaver that executes malicious code when the user applies the Windows theme. Impact of AttackAn attacker could run arbitrary code as the logged-on user. Mitigating FactorsA user cannot be forced to open the file or apply the theme; a user must be convinced to do so. Additional Information Installations using Server Core are not affected. Severity ratings do not apply to this update for all supported editions of Windows Vista and Windows Server 2008 because the known attack vectors for the vulnerability discussed in this bulletin are blocked in a default configuration. However, as a defense-in-depth measure, Microsoft recommends that customers of this software apply this security update. MS13-071: Vulnerability in Windows Theme File Could Allow Remote Code Execution (2864063)

13. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3847 CVE-2013-3851 CVE-2013-3855 ImportantNA1Remote Code ExecutionCooperatively Disclosed CVE-2013-3848 CVE-2013-3853 CVE-2013-3856 CVE-2013-3857 CVE-2013-3858 ImportantNA2Remote Code ExecutionCooperatively Disclosed CVE-2013-3849 CVE-2013-3850 CVE-2013-3852 CVE-2013-3854 ImportantNA3Remote Code ExecutionCooperatively Disclosed CVE-2013-3160 ImportantNA3Information DisclosureCooperatively Disclosed Affected Products All supported editions of Microsoft Office 2003 (including Microsoft Word 2003 and Microsoft Word Viewer), Microsoft Office 2007 (including Microsoft Word 2007 and Microsoft Office Compatibility Pack), and Microsoft Word 2010 Affected ComponentsMicrosoft Office Deployment Priority2 Main TargetWorkstations Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted file to the user and then convince the user to open the file in an affected version of Microsoft Office software. (All CVEs) In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Office file that is used to attempt to exploit this vulnerability. (All CVEs) An attacker could take advantage of compromised websites and websites that accept or host user- provided content or advertisements that contain specially crafted content. (All CVEs) MS13-072: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537)

14. Impact of Attack An attacker would be able to read data from files on the target system. This would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce information that could be used to try to further compromise the affected system. (CVE-2013-3160) An attacker could run arbitrary code in the context of the current user. (CVE-2013-3847, CVE-2013- 3848, CVE-2013-3849, CVE-2013-3850, CVE-2013-3851, CVE-2013-3852, CVE-2013-3853, CVE- 2013-3854, CVE-2013-3855, CVE-2013-3856, CVE-2013-3857, CVE-2013-3858) Mitigating Factors The vulnerability cannot be exploited automatically through email; a user must open an attachment that is sent in an email message. (All CVEs) An attacker cannot force users to visit the attacker-controlled websites. (All CVEs) MS13-072: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537) continued….

15. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-1315Important33Remote Code ExecutionCooperatively Disclosed CVE-2013-3158ImportantNA3Remote Code ExecutionCooperatively Disclosed CVE-2013-3159ImportantNA3Information DisclosureCooperatively Disclosed Affected Products Microsoft Office for Mac 2011 and all supported versions of Microsoft Excel, Microsoft Excel Viewer and Microsoft Office Compatibility Pack Affected ComponentsMicrosoft Excel Deployment Priority2 Main TargetWorkstations Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted Office file to the user and then convince the user to open the file with an affected version of Microsoft Office software. (All CVEs) In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Office file that is used to attempt to exploit this vulnerability. (All CVEs) The attacker could take advantage of compromised websites and websites that accept or host user-provided content. (All CVEs) Impact of Attack An attacker could run arbitrary code in the security context of the current user. (CVE-2013-1315, CVE-2013- 3158) An attacker would be able to read data from files on the target system. This would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce information that could be used to try to further compromise the affected system. (CVE-2013-3159) Mitigating Factors An attacker cannot force users to visit the attacker-controlled websites. (All CVEs) The vulnerabilities cannot be exploited automatically through email. For an attack to be successful a user must open an attachment that is sent in an email message. (All CVEs) Additional Information For Microsoft Office Excel 2007, customers also need to install the security update for Microsoft Office Compatibility Pack (2760588) to be protected from the vulnerabilities described in this bulletin. Microsoft Excel Viewer must be updated to a supported service pack level (Excel Viewer 2007 Service Pack 3) before installing this update. For information about supported Office viewers, see Microsoft Knowledge Base Article 979860. MS13-073: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2858300)

16. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3155 CVE-2013-3156 Important11Remote Code ExecutionCooperatively Disclosed CVE-2013-3157Important13Remote Code ExecutionCooperatively Disclosed Affected ProductsAll supported editions of Microsoft Access 2007, Microsoft Access 2010, and Microsoft Access 2013 Affected ComponentsMicrosoft Access Deployment Priority3 Main TargetWorkstations Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted Access file to the user and then convince the user to open the file. (All CVEs) In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Access file that is used to attempt to exploit this vulnerability. (All CVEs) The attacker could take advantage of compromised websites and websites that accept or host user- provided content. (All CVEs) Impact of AttackAn attacker could run arbitrary code as the current user. (All CVEs) Mitigating FactorsAn attacker cannot force users to visit the attacker-controlled websites. (All CVEs) MS13-074: Vulnerabilities in Microsoft Access Could Allow Remote Code Execution (2848637)

17. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3859ImportantNA1Elevation of PrivilegeCooperatively Disclosed Affected ProductsAll supported editions of Microsoft Office 2010 SP1 where Microsoft Pinyin IME 2010 is installed Affected ComponentsMicrosoft Office IME (Chinese) Deployment Priority3 Main TargetAny system running the affected versions of Office Possible Attack Vectors In an attack scenario, an attacker would first need to log on to the target system. An attacker could then use the IME toolbar to launch Internet Explorer with system-level privileges and could then run a program with system-level privileges. Impact of AttackAn attacker could run arbitrary code as the local system and take complete control of the system. Mitigating Factors An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. Only implementations of Microsoft Pinyin IME 2010 are affected by this vulnerability. Other versions of Simplified Chinese IME and other implementations of IME are not affected. MS13-075: Vulnerability in Microsoft Office IME (Chinese) Could Allow Elevation of Privilege (2878687)

18. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-1341 CVE-2013-1342 CVE-2013-1343 CVE-2013-3864 CVE-2013-3865 ImportantNA1Elevation of PrivilegeCooperatively Disclosed CVE-2013-1344 CVE-2013-3866 ImportantNA2Elevation of PrivilegeCooperatively Disclosed Affected Products All supported versions of Windows Client and Windows Server (except Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1) Affected ComponentsKernel-Mode Drivers Deployment Priority2 Main TargetWorkstations Possible Attack Vectors An attacker would first have to log on to the system, and could then run a specially crafted application designed to elevate privileges. (All CVEs) Impact of Attack An attacker could run arbitrary code in kernel mode. (CVE-2013-1341, CVE-2013-1342, CVE-2013-1343, CVE-2013-1344, CVE-2013-3864, CVE-2013-3865) In Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, an attacker could run arbitrary code in kernel mode. (CVE-2013-3866) In Windows 8 and Windows Server 2012, an attacker could cause the target system to stop responding. (CVE-2013-3866) Mitigating Factors An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities. (All CVEs) Additional Information Windows 8.1, Windows Server 2012 R2 and Windows RT 8.1 are considered “Latest” versions Installations using Server Core are affected. MS13-076: Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2880407)

19. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3862ImportantNA2Elevation of PrivilegeCooperatively Disclosed Affected ProductsAll supported editions of Windows 7 and Windows Server 2008 R2 Affected ComponentsWindows Service Control Manager (SCM) Deployment Priority3 Main TargetWorkstations Possible Attack Vectors In an attack scenario, an attacker could convince an authenticated user to execute a specially crafted application. The application would trigger the double free condition in the context of the Service Control Manager (SCM), which could lead to a local elevation of privilege. Impact of AttackAn attacker could execute arbitrary code within the context of another user. Mitigating Factors An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. An attacker can only gain the user rights of a user who is convinced to run the attacker's specially crafted application. Additional Information One installation using Server Core is affected (Windows Server 2008 R2 for x64-based Systems Service Pack 1). MS13-077: Vulnerability in Windows Service Control Manager Could Allow Elevation of Privilege (2872339)

20. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3137ImportantNA3Information DisclosureCooperatively Disclosed Affected ProductsAll supported editions of Microsoft FrontPage 2003 Affected ComponentsMicrosoft FrontPage Deployment Priority3 Main TargetAny systems running the affected edition of FrontPage Possible Attack Vectors In an email attack scenario, an attacker could send a specially crafted FrontPage document to the user and then convince the user to open the document. In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. An attacker could take advantage of compromised websites and websites that accept or host user- provided content or advertisements that contain specially crafted content. Impact of AttackAn attacker could disclose the contents of a local file on a target system. Mitigating Factors An attacker cannot force users to visit the attacker-controlled websites. The vulnerability cannot be exploited automatically through email; a user must open an attachment that is sent in an email message. MS13-078: Vulnerability in FrontPage Could Allow Information Disclosure (2878685)

21. CVESeverity Exploitability | Versions CommentNote LatestOlder CVE-2013-3868ImportantNA3Denial of ServiceCooperatively Disclosed Affected Products Active Directory Lightweight Directory Service (AD LDS) and Active Directory Services where affected on Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 Affected ComponentsActive Directory Deployment Priority2 Main TargetServers Possible Attack VectorsAn attacker could send a specially crafted query to the LDAP service. Impact of Attack An attacker could cause the LDAP service to become non-responsive until an administrator restarts the service. Mitigating FactorsMicrosoft has not identified any mitigations for this vulnerability. Additional Information Windows 8.1, Windows Server 2012 R2 and Windows RT 8.1 are considered “Latest” versions Installations using Server Core are affected. MS13-079: Vulnerability in Active Directory Could Lead to Denial of Service (2853587)

22. Microsoft Security Advisory (2755801): Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - On September 10, 2013, Microsoft released an update (2880289) for all supported editions of Windows 8, Windows Server 2012 and Windows RT. The update addresses the vulnerabilities described in Adobe Security Bulletin APSB13-21. For more information about this update, including download links, see Microsoft Knowledge Base Article 2880289. Note: The update for Windows RT is available via Windows Update only. The 2880289 update is also available for Internet Explorer 11 Preview in Windows 8.1 Preview and Windows 8.1 RT Preview releases. The update is available via Windows Update.

23. Detection & Deployment 1.MBSA 2.3 Preview is now available on Microsoft Connect (Microsoft Account required). This release adds support for Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2.MBSA 2.3 Preview 2.Windows RT systems only support detection and deployment from Windows Update, Microsoft Update and the Windows Store.

24. Other Update Information 1.This security update cannot be uninstalled on Office for Mac 2011.

25. During this release, Microsoft will increase/add detection capability for the following families in the MSRT: - Win32/Simda: Simda is a family of password-stealing trojans that may also allow backdoor access and control to an affected computer. Its main purpose is to steal passwords and system information from a user's machine.Win32/Simda Available as a priority update through Windows Update or Microsoft Update Offered through WSUS 3.0 or as a download at: www.microsoft.com/malwareremove

27. Submit text questions using the “Ask” button. Don’t forget to fill out the survey. A recording of this webcast will be available within 48 hours on the MSRC blog. http://blogs.technet.com/msrc Register for next month’s webcast at: http://microsoft.com/technet/security/current.aspx