Vulnerabilities / Threats
9/8/2009
05:08 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Fixes Eight Flaws, But Three Remain Open

The September patch set from Microsoft has fallen a bit short, leaving three zero-day vulnerabilities open to be exploited

Microsoft on Tuesday released five Security Bulletins addressing eight vulnerabilities, but left three zero-day vulnerabilities untended.

Paul Henry, forensic and security analyst for Lumension, said in an e-mail that the three zero-day vulnerabilities need to be addressed soon. Two are IIS vulnerabilities that were made public when exploit code was posted online about a week ago. The third is a vulnerability affecting Microsoft SMB2, for which exploit code was posted on Monday.

Microsoft said that the IIS vulnerabilities were not disclosed responsibly.

Laurent Graffie, who posted exploit code for the SMB2 vulnerability, claims that Microsoft was notified about the flaw but provides no information about the specific date the company was contacted.

Microsoft has not yet commented on the SMB2 issue.

Of the security issues that Microsoft did deal with, all five of its September Bulletins are designated "critical."

Three of them are what Microsoft characterizes as browse-and-get-owned attacks; two of them deal with network scenarios involving remote execution of malicious code or denial-of-service attacks.

MS09-045 fixes a vulnerability that allows remote code execution if a user opens a file or visits a Web site that calls a maliciously crafted Jscript.

MS09-047 patches two flaws in the Windows Media format that allow remote code execution upon opening a maliciously crafted file.

Both of these Bulletins are rated 1 on Microsoft's Exploitability Index, meaning that attackers are likely to start exploiting these vulnerabilities soon.

MS09-046 repairs a flaw in the DHTML Editing Component ActiveX Control. Producing exploit code for this flaw is believed to be somewhat complicated, giving it a less severe Exploitability Index rating of 2.

MS09-048 addresses three vulnerabilities in Windows TCP/IP.

And MS09-049 deals with one flaw in Windows' Wireless LAN AutoConfig Service.

Jason Miller, security and data team manager for Shavlik Technologies, says that the TCP/IP patch (MS09-048) should be applied first. "This bulletin resolves three vulnerabilities in the networking component TCP/IP," he said in an e-mailed statement. "In two of the vulnerabilities, attacks could cause a denial of service on target machines by sending specially crafted network packets that will cause the system to freeze or automatically restart."

Andrew Storms, director of security operations for nCircle, concurs. "Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," he said in an e-mailed statement. "This update follows on the heels of yesterday's new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

Microsoft senior security program manager Jerry Bryant argues that MS09-045 and MS09-047 should be installed first, "mainly due to these being browse-and-own attack scenarios and a high Exploitability Index rating."


InformationWeek Analytics has published an independent analysis on strategic security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.