Vulnerabilities / Threats
9/8/2009
05:08 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Fixes Eight Flaws, But Three Remain Open

The September patch set from Microsoft has fallen a bit short, leaving three zero-day vulnerabilities open to be exploited

Microsoft on Tuesday released five Security Bulletins addressing eight vulnerabilities, but left three zero-day vulnerabilities untended.

Paul Henry, forensic and security analyst for Lumension, said in an e-mail that the three zero-day vulnerabilities need to be addressed soon. Two are IIS vulnerabilities that were made public when exploit code was posted online about a week ago. The third is a vulnerability affecting Microsoft SMB2, for which exploit code was posted on Monday.

Microsoft said that the IIS vulnerabilities were not disclosed responsibly.

Laurent Graffie, who posted exploit code for the SMB2 vulnerability, claims that Microsoft was notified about the flaw but provides no information about the specific date the company was contacted.

Microsoft has not yet commented on the SMB2 issue.

Of the security issues that Microsoft did deal with, all five of its September Bulletins are designated "critical."

Three of them are what Microsoft characterizes as browse-and-get-owned attacks; two of them deal with network scenarios involving remote execution of malicious code or denial-of-service attacks.

MS09-045 fixes a vulnerability that allows remote code execution if a user opens a file or visits a Web site that calls a maliciously crafted Jscript.

MS09-047 patches two flaws in the Windows Media format that allow remote code execution upon opening a maliciously crafted file.

Both of these Bulletins are rated 1 on Microsoft's Exploitability Index, meaning that attackers are likely to start exploiting these vulnerabilities soon.

MS09-046 repairs a flaw in the DHTML Editing Component ActiveX Control. Producing exploit code for this flaw is believed to be somewhat complicated, giving it a less severe Exploitability Index rating of 2.

MS09-048 addresses three vulnerabilities in Windows TCP/IP.

And MS09-049 deals with one flaw in Windows' Wireless LAN AutoConfig Service.

Jason Miller, security and data team manager for Shavlik Technologies, says that the TCP/IP patch (MS09-048) should be applied first. "This bulletin resolves three vulnerabilities in the networking component TCP/IP," he said in an e-mailed statement. "In two of the vulnerabilities, attacks could cause a denial of service on target machines by sending specially crafted network packets that will cause the system to freeze or automatically restart."

Andrew Storms, director of security operations for nCircle, concurs. "Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," he said in an e-mailed statement. "This update follows on the heels of yesterday's new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

Microsoft senior security program manager Jerry Bryant argues that MS09-045 and MS09-047 should be installed first, "mainly due to these being browse-and-own attack scenarios and a high Exploitability Index rating."


InformationWeek Analytics has published an independent analysis on strategic security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.