Prepare for a Record Breaking Microsoft Patch Day Tomorrow

Prepare for a Record Breaking Microsoft Patch Day Tomorrow
from WatchGuard Security Center by Corey Nachreiner

I don’t know about you, but I really don’t like hearing “record breaking” and “Microsoft Patch Day” in the same sentence. Unfortunately, April’s Black Tuesday will be just that — a record breaking patch day.

According to their Advanced Notification page, Microsoft plans to release an unprecedented 17 Security Bulletins tomorrow. The bulletins will fix security flaws in Windows, Office, and Internet Explorer (IE), as well as some issues in some of Microsoft’s Server and Developer software. Microsoft rates more than half the bulletins (nine) as Critical, which typically means attackers can leverage them to execute code on your computer, and gain control of it.


The quicker you can apply Microsoft’s patches the better. Attackers often take advantage of the “vulnerability window,” which is the period of time between when an attacker learns about a vulnerability and when you patch that vulnerability. Often, attackers and security researchers will reverse engineer Microsoft’s patches to learn more about the underlying vulnerabilities they fix. In fact, it’s not uncommon for exploit code to surface shortly after patch day. For this reason, I recommend you prepare your staff for a deluge of patches tomorrow, and try your best to test and apply them quickly, despite their great number.

I’ll know more about these bulletins tomorrow, and will publish alerts about them here. — Corey Nachreiner, CISSP

Windows zero day and small Snow Leopard update start off the new year

Windows zero day and small Snow Leopard update start off the new year
from WatchGuard Security Center by Corey Nachreiner

A fresh new year has begun and we already have security vulnerabilities in two of the most popular operating systems; Windows and OS X. Let’s start with the more worrisome one – Windows.

According to a recent Microsoft Security Advisory, the Graphics Rendering Engine that ships with most versions of Windows (one of the components that helps display graphics on your screen) suffers from a zero day vulnerability. Specifically, a flaw in how the Graphics Rendering engine parses specially crafted thumbnail images could result in a buffer overflow. By enticing you to preview a thumbnail image, perhaps hosted on a website or sent within an email, an attacker could exploit this flaw to execute code on your computer, with your privileges. If you’re a local administrator, the attacker gets the keys to your castle.

Microsoft doesn’t have a patch for this vulnerability, but they do describe a workaround that will mitigate some attacks. See the “Mitigating Factors and Suggested Actions” section of their advisory for more details. Unfortunately, they don’t say whether or not attackers are exploiting this zero day in the wild. Though Patch Day is coming up next week, I doubt Microsoft will get this fix out by then, so be sure to be careful handling thumbnail images.

Next up is Apple. Late yesterday, Apple released a security update for OS X 10.6.x (Snow Leopard). The update only seems to fix one marginally severe vulnerability. Apple’s alert doesn’t describe the flaw in much technical detail. They only say that a format string flaw in PackageKit could allow an attacker to execute code on your Mac. In order to exploit this flaw, the attacker would need to deliver a malicious package via Apple’s Software Update, which means he would need to complete a Man-in-the-Middle attack to gain control of where Software Update gets its package from. In short, attackers will have a hard time leveraging this flaw without local access to your network. Nonetheless, Snow Leopard users should download the 10.6.6 update or let Software Update do it for them.

In summary, if you’re a Windows user, be careful with thumbnails, and look for updates next Tuesday, and if you’re a Snow Leopard user, upgrade as soon as you can.

– Corey Nachreiner, CISSP

HIGH: Two MS Office Security Bulletins Fix 7 - Seven Vunerabilities

Broadcast - Articles
TWO OFFICE SECURITY BULLETINS FIX SEVEN VULNERABILITIES

SEVERITY: HIGH

9 November, 2010

SUMMARY:

* These vulnerabilities affect: Most current versions of
Microsoft Office, and the components that ship with it

* How an attacker exploits it: Typically by enticing one of your
users to open a malicious Office document

* Impact: In the worst case, an attacker executes code on your
user's computer, gaining complete control of it

* What to do: Install Microsoft Office updates as soon as
possible, or let Microsoft's automatic update do it for you

---------------------------------------------------------------
This is a summary, for the complete alert, see Watchguard's web page:
https://www.watchguard.com/archive/showhtml.asp?pack=120268
--------------------------------------------------------------

STATUS:

Microsoft has released Office updates to fix these vulnerabilities.


REFERENCES:

* MS Security Bulletin MS10-087
http://www.microsoft.com/technet/security/bulletin/MS10-087.mspx

* MS Security Bulletin MS10-088
http://www.microsoft.com/technet/security/bulletin/MS10-088.mspx

This alert was researched and written by Corey Nachreiner, CISSP.

HIGH: More Security Vulnerabilities Affect Word and Excel

--------------------------------------------------
Broadcast - Articles
MORE SECURITY VULNERABILITIES AFFECT WORD AND EXCEL

SEVERITY: HIGH

12 October, 2010

SUMMARY:

* These vulnerabilities affect: All current versions of
Microsoft Office for Windows and Mac (specifically Word and
Excel)

* How an attacker exploits them: Typically, by enticing you to
open maliciously crafted Office documents

* Impact: An attacker can execute code, potentially gaining
complete control of your computer

* What to do: Install the appropriate Office patches
immediately, or let Windows Update do it for you.

---------------------------------------------------------------
This is a summary, for the complete alert, see our web page:
https://www.watchguard.com/archive/showhtml.asp?pack=1120003
--------------------------------------------------------------

STATUS:

Microsoft has released Office updates to fix these vulnerabilities.


REFERENCES:

* MS Security Bulletin MS10-079


* MS Security Bulletin MS10-080


This alert was researched and written by Corey Nachreiner, CISSP.