Vulnerabilities / Threats
9/8/2009
05:08 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Fixes Eight Flaws, But Three Remain Open

The September patch set from Microsoft has fallen a bit short, leaving three zero-day vulnerabilities open to be exploited

Microsoft on Tuesday released five Security Bulletins addressing eight vulnerabilities, but left three zero-day vulnerabilities untended.

Paul Henry, forensic and security analyst for Lumension, said in an e-mail that the three zero-day vulnerabilities need to be addressed soon. Two are IIS vulnerabilities that were made public when exploit code was posted online about a week ago. The third is a vulnerability affecting Microsoft SMB2, for which exploit code was posted on Monday.

Microsoft said that the IIS vulnerabilities were not disclosed responsibly.

Laurent Graffie, who posted exploit code for the SMB2 vulnerability, claims that Microsoft was notified about the flaw but provides no information about the specific date the company was contacted.

Microsoft has not yet commented on the SMB2 issue.

Of the security issues that Microsoft did deal with, all five of its September Bulletins are designated "critical."

Three of them are what Microsoft characterizes as browse-and-get-owned attacks; two of them deal with network scenarios involving remote execution of malicious code or denial-of-service attacks.

MS09-045 fixes a vulnerability that allows remote code execution if a user opens a file or visits a Web site that calls a maliciously crafted Jscript.

MS09-047 patches two flaws in the Windows Media format that allow remote code execution upon opening a maliciously crafted file.

Both of these Bulletins are rated 1 on Microsoft's Exploitability Index, meaning that attackers are likely to start exploiting these vulnerabilities soon.

MS09-046 repairs a flaw in the DHTML Editing Component ActiveX Control. Producing exploit code for this flaw is believed to be somewhat complicated, giving it a less severe Exploitability Index rating of 2.

MS09-048 addresses three vulnerabilities in Windows TCP/IP.

And MS09-049 deals with one flaw in Windows' Wireless LAN AutoConfig Service.

Jason Miller, security and data team manager for Shavlik Technologies, says that the TCP/IP patch (MS09-048) should be applied first. "This bulletin resolves three vulnerabilities in the networking component TCP/IP," he said in an e-mailed statement. "In two of the vulnerabilities, attacks could cause a denial of service on target machines by sending specially crafted network packets that will cause the system to freeze or automatically restart."

Andrew Storms, director of security operations for nCircle, concurs. "Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," he said in an e-mailed statement. "This update follows on the heels of yesterday's new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

Microsoft senior security program manager Jerry Bryant argues that MS09-045 and MS09-047 should be installed first, "mainly due to these being browse-and-own attack scenarios and a high Exploitability Index rating."


InformationWeek Analytics has published an independent analysis on strategic security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

CVE-2013-6041
Published: 2014-12-27
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action.

CVE-2013-6043
Published: 2014-12-27
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

CVE-2013-6227
Published: 2014-12-27
Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format param...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.