Microsoft has released 13 new security bulletins in the October 2009 version of Patch Tuesday. Eight bulletins are rated with a severity rating of Critical. The remaining five security bulletins have a severity rating of Important. For the first time, Windows 7 and Windows 2008 R2 are affected by security bulletins. The sheer volume of bulletins and subsequent patches this month will likely give administrator fits.
Two previously active Microsoft Security Advisories have been closed out:
Security Advisory 975497: Vulnerabilities in SMB Could Allow Remote Code Execution
Security Advisory 975191: Vulnerabilities in the FTP Service in Internet Information
These security advisories have been addressed with the new security bulletins MS09-050 and MS09-053. MS09-050 resolves three software vulnerabilities and is rated Critical. A user can send malicious networking packets to a target system that can lead to remote code execution on the target system. This code was already publically available, so the likelihood of a new major outbreak is unlikely. MS09-053 resolves two software vulnerabilities in the FTP service. These vulnerabilities could result in remote code execution on the target machine. The vulnerabilities covered by these bulletins were both publically known.
The User Experience:
Two bulletins affect the “User Experience” this month. MS09-054 is Microsoft’s cumulative security update for the Internet Explorer browser. This bulletin addresses four vulnerabilities, one that is publically known, and is rated Critical. Users can be affected if they visit a specially crafted web page. This can lead to remote code execution. MS09-062 affects GDI+. The bulletin addresses an issue where specially crafted images can be embedded in web pages. If a user visits a specially crafted web page, a vulnerability can be exploited that can lead to remote code execution. In addition, opening specially crafted Microsoft Office documents can result in remote code execution as well. These will probably be the most targeted as both attack vectors have a large user base and require simple navigation to a malicious web site. In both cases, users must be enticed to visit a malicious web site or open a malicious Office document.
The Media Experience:
The next two bulletins affect media playing on target systems. MS09-051 affects the Windows Media Runtime component. If a user opens a malicious streaming media file (ASF), an attacker could gain complete control of the system through remote code execution. An attacker would need to entice a user to visit a website or opening a file to exploit this vulnerability. This bulletin is rated as Critical and addresses two software vulnerabilities. One of these vulnerabilities is publically known. MS09-052 is very similar to the previous security bulletin. This bulletin affects Windows Media Player, addresses one software vulnerability, and is rated Critical. The vulnerability has the same attack vectors as MS09-051 with one more addition. With Windows Media Player, a user would simply need to navigate to a directory containing a malicious file through explorer. Simply browsing to the folder, and not opening the file, will trigger the exploit.
ATL Part Two:
A few months back, Microsoft released an out-of-band that addressed software vulnerabilities with ATL components. This month, Microsoft is back with a few more patches that address ATL issues. First, MS09-055 is a bulletin that will place Active-X killbits on a machine. This will prevent malicious Active-X controls from opening. This bulletin fixes one software vulnerability and will block 15 malicious Active-X controls from running. There were reports of exploits in the wild taking advantage of this vulnerability. MS09-060 addresses three vulnerabilities in ATL Active-X controls in Microsoft Office. Users can be affected if they are enticed into navigating to a malicious website that can lead to remote code execution. This bulletin is rated as Critical.
The Rest:
MS09-061 addresses three vulnerabilities affecting .NET and Silverlight 2 and is rated Critical. If a user visits a malicious website, an attacker can gain Remote Code execution.
MS09-057 addresses one vulnerability in the Windows Indexing Service and is rated Important. Like other vulnerabilities, it requires a user to navigate to a malicious website. But, the user needs to have a vulnerable binary on the target system for the exploit to work. This could lead to remote code execution on the target system. Based on the difficulty of the attack scenario, an exploitation outbreak on the vulnerability is lower than the other User Experience vulnerabilities.
MS09-058 addresses three vulnerabilities in the Windows Kernel. This bulletin is rated as Important. An attacker would need to have access to a target system before being able to exploit this vulnerability. If successful, the attacker could cause a Denial of Service or elevate their privileges on the system. In order to exploit this vulnerability, an attacker would need to combine this exploit with additional exploits to gain access to the target system.
MS09-056 addresses two vulnerabilities in CryptoAPI and is rated Important. This vulnerability can lead to a spoofing attack. If an attack is successful, an attacker can impersonate another user by displaying a digital certificate that appears to be legitimate.
MS09-059 addresses one vulnerability in Local Security Authority Subsystem (LSASS) and is rated Important. This vulnerability can lead to a Denial of Service attack. If an attack is successful, the target system could automatically restart itself causing a Denial of Service.
Adobe:
As this is October, Adobe has also released their quarterly security bulletins for Adobe Acrobat and Reader. Adobe will be releasing Adobe Reader and Acrobat for versions 9.1.3, 8.1.6 and 7.1.3.
Re-released:
Microsoft has re-released a new major revision to MS08-069. This bulletin now includes patches affecting Windows 7 and Windows 2008 R2.
If you are a Shavlik NetChk product user, it is important to note the change in our XML data release schedule for this patch Tuesday. We are breaking our releases in two releases instead of one release. The reasoning behind this is the amount of data that needs to be entered, tested and released for use. We will first be focusing on the eight critical Microsoft security bulletins. When testing passes, we will release the XML. After the release, we will immediately be working on the remaining five important Microsoft security bulletins, Adobe security bulletins and Microsoft re-releases.
If you would like more information on each of these bulletins, I will be detailing each Security Bulletin during our monthly Patch Tuesday webinar tomorrow. Webinar registration is located here.
Happy patching and good luck to everyone this month!
- Jason Miller
