SpiderLabs Anterior

Microsoft Patch Tuesday, June 2013

Finally, patch Tuesday has arrived and fortunately this one will be a real treat. This release should be a breeze with only five (5) bulletins, which only one of these being critical. Some of these bulletins might not affect you if you are running a Windows 64-bit system (such as MS13-048) or running an unaffected version of Microsoft Office (MS13-051).  So I'm expecting the update process will go fairly quickly, so no need to wait to perform these security updates before bed time or during lunch. But of-course there is no guarantees. However, I would 'Just do it' as the Nike slogan says. But, there is always the exception if your running a critical application on a Windows Server where you need to schedule a time-window to get security updates installed, but this shouldn't be a big deal.  Without further ado, let's jump into these bulletins.

Microsoft Advance Notification for June 2013

So far this year we has had two Patch Tuesday months with seven bulletins (January and March) and two with ten bulletins (April and May) and one with twelve (February) so I am very glad that we only have five bulletins this month. That gives us all more time to go out and enjoy the summer weather. Although just because there is only five bulletins this month doesn’t mean we shouldn’t pay attention to them. First if you are planning ahead note that four of these bulletins will require a restart after installing and the fifth one might, probably depending on what else you have installed.  Definitely pay attention to bulletin number one, which is a critical remote execution flaw in Internet Explorer, which looks like it impacts versions 6 thru 10. The rest are all rated Important, with an Elevation of Privilege, a Denial of Service and an Information Disclosure issue in Windows and a remote code execution issue in Microsoft Office. The interesting part about the Office Patch is that it impacts Office 2003 SP3 and Mac Office 2011

See you next Tuesday with all the gory details!

 

 

Microsoft Patch Tuesday, May 2013

I keep hoping for an easy relaxing Patch Tuesday of say, only two or three bulletins but so far this year things haven’t been so easy. So far this year we have Patch Tuesdays of seven, ten and seven bulletins, respectfully, and this month we have ten.  (hmm, is there a pattern there?) Not only that we have a zero-day vulnerability in Internet Explorer to deal with. I long for months like September 2012 when there were but two bulletins but I should feel lucky that its not December 2010 or April 2011 when we had no less than seventeen bulletins. I’ll take the ten and be happy. 

This month there are only two critical patches, both covering remote code execution, both in Internet Explorer. The rest are all rated as Important and can be found in Windows, Lync, Publisher and Word. Bulletin Nine is in Windows Essentials, which is a product we haven’t seen much of here on Patch Tuesday. 

Microsoft Advance Notification for May 2013

There will be ten bulletins released by Microsoft next Tuesday and one of those should be for the recent Internet Explorer zero-day discovered earlier this week.  Buletin 2 should cover the remote code execution of the IE-8 0day while Bulletin 1 will also cover RCE in IE 6 thru 10.  We suspect Bulletin 1 will fix the issue discovered during the PWN2OWN competition at CanSecWest earlier this year.

Bulletins 3, 4, and 10 are in Windows itself including .NET. They are rated Important and cover Denial of Service, Spoofing and Elevation of Privilege vulnerabilities.

Bulletins 5, 6, and 7 are all rated Important and all three result in remote code execution in parts of Microsoft Office. Specifically Communicator and Lync, Publisher and Word in that order.

Bulletin 9 is also rated as Important and results in Information Disclosure in Windows Essentials. Don’t get confused with Security Essentials. Windows Essentials is a free software pack for Windows 7 that includes Mail, Movie Maker, Messenger and other useful apps that Microsoft gives away.

 

Mayday! 0-Day

While many workers around the world were celebrating the May 1st events, the US Department of Labor website got hacked and was used to redirect browsers to a 3rd party site which served a new IE 8 0day exploit, known as CVE-2013-1347. Microsoft already released an advisory about it last Friday.

Having a quick look at the in-the-wild exploit code, it can be seen that the exploit creator targeted only victims running IE 8 on windows XP computers, by using Javascript that triggers the exploit based on the user agent. However, the exploit can work with IE8 on other versions of Windows such as Windows 7. The reason for limiting this attack to Windows XP users is currently unknown. 

Apparently, the attackers collected technical statistics on the victims’ browser plugins BEFORE serving them with the IE exploit, for example whether plug-ins from their antivirus product, from Fiddler Proxy or from TamperData are installed. That information is then sent to the aforementioned 3rd party site. 

According to a tweet from one of Metasploits’ exploit developers, a module for this CVE will be released soon. Therefore an increase in exploit attempts of this CVE is quite likely.

And to the good news: Trustwave SWG Server (versions 10.1 and higher) blocks this attack out-of-the-box using its generic protection engines, without any further update, thus maintaining good record of blocking the recent 0-day attakcs.

Microsoft Patch Tuesday, April 2013

This month we have nine bulletins, two critical covering just fourteen CVEs. The critical bulletins are in Internet Explorer and Remote Desktop Client, two areas we have seen a lot of vulnerabilities. The rest are all rated important. One of those in Windows Defender and one in Active Directory are in areas we haven’t seen much activity lately. 

One thing to keep in mind is that this month marks one year left on support for Windows XP. That means no more security updates or patches for those of you still holding on to XP SP3 which is now five years old. (Windows XP with no service packs is now a teenager.) Some estimates put the installed base of XP at 40% of all PCs, which seems like an absurdly high number. The issue for many larger companies seems to be custom built applications that need to be rewritten to work on newer operating systems and outdated hardware, which in this economy no one wants to pay to update. I guess they can either pay now to update or pay later when they have lost their intellectual property to attackers or their productivity to downtime as a result of attacks.

Microsoft Advance Notification for April 2013

Ah, April, for most of us the weather is turning warm, birds return to their trees, flowers start blooming and the Red Sox lead the American League East, at least for a day or two. Some of us will get to go outside and enjoy those things and some of us will get to spend some quality time in our server rooms applying patches. We have nine bulletins from Microsoft this month, two of them critical.  Five bulletins deal directly with Windows, one with Internet Explorer 6, 7, and 8, one with SharePoint, one with Windows Defender and one that impacts Microsoft InfoPath 2010, SharePoint, Groove Server and Office Web Aps.

Microsoft Patch Tuesday, March 2013 – Happy St. Patch-rick's Day!

Saint Patrick’s day is quickly becoming Saint Patrick’s week. Some cities have scheduled their parade a week earlier than the actual day, which I guess means an extended period of green beer. Hopefully the luck of Irish is with you this month as Microsoft rolls out seven bulletins that may impact your systems. If they attackers get lucky they could end up execute arbitrary remote code so grab your lucky charm and apply these patches as soon as you can so you go grab some of that green beer before it is all gone.

Microsoft Advance Notification for March 2013

First the raw numbers; we have seven bulletins this month, four critical, and three important. There are three Remote Code Executions, two Elevation of Privilege and two Information Disclosures.  Two of the patches definitely require a reboot of your machine, three of them might and two you can get away without restarting after installation.

All right that’s the numbers, lets look at what we are dealing with here. Bulletin One is RCE, is rated as critical and impacts just about every version of Windows from XP SP3 on up and Internet Explorer 6 thru 10.  My guess is this will probably be a use after free vulnerability, we’ve seen a lot of those lately, they impact a lot of stuff and often result in in RCE.

Microsoft Patch Tuesday, February 2013 – Happy Chinese New Year!

Submitted by Space Rogue

Happy Chinese New Year! Welcome to the year of the snake, or the black water snake to be technical.

I know what you're thinking, in between slurping on your long noodles and noshing on your tangerines, you're thinking that twelve security bulletins from Microsoft for the month of February isn't that bad even if it is the short month. Twelve isn't great but it is a manageable number. While twelve bulletins sounds like an easy number keep in mind that those twelve bulletins cover a whopping fifty-seven separate CVEs. Having to fill the gaps of fifty-seven CVEs might be almost as bad having to battle the mythical Nian beast before it gobbles up your children. So put on your best red shirt and maybe these fifty-seven CVEs can be scared into submission.

Lets get this Chinese New Years Party started!