This month we have nine bulletins, two critical covering just fourteen CVEs. The critical bulletins are in Internet Explorer and Remote Desktop Client, two areas we have seen a lot of vulnerabilities. The rest are all rated important. One of those in Windows Defender and one in Active Directory are in areas we haven’t seen much activity lately.
One thing to keep in mind is that this month marks one year left on support for Windows XP. That means no more security updates or patches for those of you still holding on to XP SP3 which is now five years old. (Windows XP with no service packs is now a teenager.) Some estimates put the installed base of XP at 40% of all PCs, which seems like an absurdly high number. The issue for many larger companies seems to be custom built applications that need to be rewritten to work on newer operating systems and outdated hardware, which in this economy no one wants to pay to update. I guess they can either pay now to update or pay later when they have lost their intellectual property to attackers or their productivity to downtime as a result of attacks.
Remote Code Execution in Internet Explorer
As we suspected last week this issue with Internet Explorer is another use-after-free vulnerability where the application continues to use memory after it has been released. In this case an attacker could execute remote code if they can get a user to view a specially crafted webpage using Internet Explorer.
Remote Code Execution in Remote Desktop Client
It has been a few months since we have had an RDP vulnerability but I was pretty sure we hadn’t seen the last of them. In this case getting a user to visit a specially crafted webpage could result in remote code execution. The actual flaw is located in the ActiveX control mstscax.dll, which attempts to access an object in memory that has been deleted.
Information Disclosure in Sharepoint
If an attacker can determined the address or location of a specific SharePoint list and has gained access to the SharePoint site where the list is maintained they could gain access to list items that they weren’t supposed to access. Of course the attacker would still need to authenticate to SharePoint in order to take advantage of this vulnerability. If you have not already installed the Project Server 2013 cumulative update you should probably do that first, otherwise Microsoft Update will not offer you this update and if you try to download the update manually the download may fail. While this vulnerability was publicly disclosed Microsoft hasn’t seen it being exploited in the wild, yet.
Elevation of Privilege in Windows Kernel
You don’t see race conditions very often in Windows these days but this month we have two of them. Both of them deal with how Windows handles objects in memory, which could allow an attacker to gain elevated privileges and read arbitrary amounts of kernel memory if successfully exploited. In both cases the attacker must be able to log on locally to a machine to take advantage of this flaw. Remember that locally in this case includes via Remote Desktop.
Denial of Service in Active Directory
If an attacker sends a specially crafted query to the Lightweight Directory Access Protocol (LDAP) service they could cause the service to stop responding resulting in a denial of service. An interesting aspect of this vulnerability is that it does not impact Itanium based servers.
Elevation of Privilege in Windows Client/Server Run-time Subsystem (CSRSS)
You are probably asking what the hell is the Client/Server Run-time subsystem? Well, it is the user-mode portion of the Win32 subsystem. Win32.sys is the other part and is the kernel-mode portion. CSRSS is responsible for handling console windows, creating and/or deleting threads, it’s an essential subsystem that must be running at all times. Unfortunately if an attacker has logon credentials to a system and can run a specially crafted application that would then allow them to delete data or even create new accounts with full user rights.
Elevation of Privilege in Windows Defender
Windows Defender is Microsoft’s AntiMalware client in Windows 8 and RT. The pathnames it uses could allow an elevation of privilege to an attacker who is able to successfully exploit this vulnerability. Don’t get confused here; the AntiMalware Client is not updated with the Microsoft Malware Protection Engine and malware definitions updates so depending on the version of Windows Defender you have installed you may or may not see this offered to you via Microsoft update. If you don’t see it offered then you should try to update manually, most users with up to date software should not have any issues here. You should definitely install this update as soon as you can, Microsoft thinks that this vulnerability will be pretty easy to exploit and expects exploit code to be written for this fairly soon.
Elevation of Privilege in HTML Sanitization Component
Who remembers MS12-066? Yeah, didn’t think so. It was issued in October of last year and was very similar to the issue this month. The flaw is in the HTML sanitization routines that can impact InfoPath 2010 Groove Server, Office Web apps and most significantly SharePoint Foundation 2010. The bad strings could allow cross-site scripting attacks that could run scripts in the context of the logged-on user resulting in an Elevation of Privilege. Like last October’s vulnerability this one was found in the wild on a limited basis making it doubly important to get those patches installed quickly.
Elevation of Privilege in Kernel Mode Drivers
CVE-2013-1283 CVE-2013-1291 CVE-2013-1292 CVE-2013-1293
This one requires that an attacker already have access to a system, but once they do they can run a specially crafted application to increase their privilege level. If you are looking in Microsoft Update and you see multiple updates being offered that is normal, you will need to install them all. There are four different CVEs here, which may account for the multiple update packages. Two of them are a race condition, one is a font parsing vulnerability and one is a null pointer deference vulnerability. CVE-2013-1283, one of the race conditions, is already being exploited to some extent in the wild and CVE-2013-1292, the other race condition, looks to be pretty easy to exploit so be sure to apply this patch as soon as you can.