Vulnerabilities / Threats
9/8/2009
05:08 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Fixes Eight Flaws, But Three Remain Open

The September patch set from Microsoft has fallen a bit short, leaving three zero-day vulnerabilities open to be exploited

Microsoft on Tuesday released five Security Bulletins addressing eight vulnerabilities, but left three zero-day vulnerabilities untended.

Paul Henry, forensic and security analyst for Lumension, said in an e-mail that the three zero-day vulnerabilities need to be addressed soon. Two are IIS vulnerabilities that were made public when exploit code was posted online about a week ago. The third is a vulnerability affecting Microsoft SMB2, for which exploit code was posted on Monday.

Microsoft said that the IIS vulnerabilities were not disclosed responsibly.

Laurent Graffie, who posted exploit code for the SMB2 vulnerability, claims that Microsoft was notified about the flaw but provides no information about the specific date the company was contacted.

Microsoft has not yet commented on the SMB2 issue.

Of the security issues that Microsoft did deal with, all five of its September Bulletins are designated "critical."

Three of them are what Microsoft characterizes as browse-and-get-owned attacks; two of them deal with network scenarios involving remote execution of malicious code or denial-of-service attacks.

MS09-045 fixes a vulnerability that allows remote code execution if a user opens a file or visits a Web site that calls a maliciously crafted Jscript.

MS09-047 patches two flaws in the Windows Media format that allow remote code execution upon opening a maliciously crafted file.

Both of these Bulletins are rated 1 on Microsoft's Exploitability Index, meaning that attackers are likely to start exploiting these vulnerabilities soon.

MS09-046 repairs a flaw in the DHTML Editing Component ActiveX Control. Producing exploit code for this flaw is believed to be somewhat complicated, giving it a less severe Exploitability Index rating of 2.

MS09-048 addresses three vulnerabilities in Windows TCP/IP.

And MS09-049 deals with one flaw in Windows' Wireless LAN AutoConfig Service.

Jason Miller, security and data team manager for Shavlik Technologies, says that the TCP/IP patch (MS09-048) should be applied first. "This bulletin resolves three vulnerabilities in the networking component TCP/IP," he said in an e-mailed statement. "In two of the vulnerabilities, attacks could cause a denial of service on target machines by sending specially crafted network packets that will cause the system to freeze or automatically restart."

Andrew Storms, director of security operations for nCircle, concurs. "Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," he said in an e-mailed statement. "This update follows on the heels of yesterday's new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

Microsoft senior security program manager Jerry Bryant argues that MS09-045 and MS09-047 should be installed first, "mainly due to these being browse-and-own attack scenarios and a high Exploitability Index rating."


InformationWeek Analytics has published an independent analysis on strategic security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio