Overview 
This month, Microsoft released two patches that address a total of two vulnerabilities. Both are cross-site scripting vulnerabilities, which may result in elevation of privilege.

As always, BeyondTrust suggests that all users apply Microsoft patches as fast as possible, preferably after testing the impact on internal applications and network continuity. For those who would like further information regarding the potential risks and remediation requirements of the patches announced today, please consider attending tomorrow's Vulnerability Expert Forum hosted by the BeyondTrust Security Research Team.

Register Now >>

Web Event:

Vulnerability Expert Forum (VEF)

 

Presenters:

The BeyondTrust Research Team

 

Date/Time: 

Wednesday, Sept 12th 

1pm PT / 4pm ET / 9pm GMT
 

Register for Webinar >>

MS12-061
Vulnerability in Visual Studio Team Foundation Server Could Allow Elevation of Privilege (2719584)
Microsoft Rating: Important
CVE: CVE-2012-1892

Analysis
This bulletin addresses a privately reported elevation of privilege vulnerability in Visual Studio Team Foundation Server. The patch fixes a reflected cross-site scripting vulnerability. An attacker that successfully exploited this vulnerability would gain the ability to execute JavaScript on behalf of a currently logged on user.

Recommendations
Deploy patches as soon as possible. Until the patch can be installed, ensure that the IE8 and IE9 XSS filter is enabled in the Local intranet security zone.


MS12-062
Vulnerability in System Center Configuration Manager Could Allow Elevation of Privilege (2741528)
Microsoft Rating: Important
CVE List: CVE-2012-2536

Analysis 
Recommendations