BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

January 2014 Patch Tuesday

Post by BeyondTrust Research Team January 14, 2014

Welcome to 2014! This month is a light month for Patch Tuesday bulletins. Microsoft has released patches for Microsoft Word and Office Web Apps, the Windows Kernel (and drivers), and Microsoft Dynamics AX. There are a total of four bulletins addressing six unique vulnerabilities; all of which are rated as important.

The NDProxy zero-day vulnerability from November, CVE-2013-5065, is receiving a fix this month in MS14-002. It affects XP and Server 2003. Attackers have been actively exploiting this vulnerability in the wild. Publicly available exploit frameworks have also incorporated exploits targeting this vulnerability. Given the high availability of exploits for this vulnerability, it is imperative that administrators deploy this patch immediately.

MS14-001, a fix for Microsoft Word and Office Web Apps, patches three vulnerabilities that could lead to remote code execution in the context of the current user. This bulletin covers Word 2003, 2007, 2010, and 2013, Office Web Apps 2010/2013, as well as Word Automation Services on SharePoint Server 2010/2013. Exploitation of this vulnerability would require that a user open a maliciously crafted Word document, which would exploit one of the vulnerabilities. Because this affects so many versions of Word, it is important to get this deployed as soon as possible.

MS14-003 addresses a vulnerability in Windows 7 and Server 2008 R2, affecting Windows kernel drivers. The vulnerability occurs when the driver improperly uses window handle thread-owned objects. Attackers can exploit this vulnerability to gain the ability to execute arbitrary code in the context of the kernel. This is very similar to the vulnerability fixed by MS14-002, which also provides attackers kernel level privileges if properly exploited. Make sure to deploy this patch as soon as possible.

The last patch of the month, MS14-004, fixes a vulnerability in Microsoft Dynamics AX, which could be used to cause a denial of service condition. This privately reported vulnerability affects a few versions of Dynamics AX (4.0 SP2, 2009 SP1, 2012, and 2012 R2). It is caused by a failure to properly handle user input, which could result in the server failing to respond to further client requests. Deploy this patch when possible.

Be sure to patch the NDProxy 0day (MS14-002), Word and Office Web Apps (MS14-001), Windows kernel-mode drivers (MS14-003), and Microsoft Dynamics AX (MS14-004). Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, January 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

>> Hello VEF Attendees! Participate in our monthly giveaway here. Answer the question in the comments to win an iPad Air!

In light of the recent breaches of cardholder data at both Target and Neiman Marcus, we want to know, have you since thought about how to improve or build upon your payment application security?

Why or why not?

Most insightful and/or awesome answer wins!

>> VEF News Articles

NSA Hackers Get the ‘Ungettable’ With Rich Catalog of Custom Tools

Secret contract tied NSA and security industry pioneer

UAE finds US backdoor in satellite

iOS 7 Jailbreak

iOS 7 Jailbreak Security Fail

Major Breach at Target

>> VEF Questions & Comments

Related to the Target breach, Jason mentioned that you can sign up for one free year of credit monitoring through Target, as part of Target’s response to the data breach.

William asked, “…how Target could have prevented the Dexter Malware from scraping the PANS”. After doing some research on Primary Account Numbers (PANs) and card track data in general, there are a number of third party solutions available that provide Point to Point Encryption (P2PE), which can help safeguard payment information. Devices, such as card readers and PIN pads, encrypt card data before it reaches a POS device using Format Preserving Encryption, which allows POS systems to use the encrypted data as if it were card data. Solutions that use P2PE may have stopped the Dexter malware used against Target and other merchants from being effective.

Thank you to all who attended this month’s VEF! We appreciate all the questions and comments. If there was a question you asked that we did not answer on the VEF, or did not mention in this blog post, please contact us directly research@BeyondTrust.comHappy New Year!

Tags:
, , ,

Leave a Reply

6 Responses to “January 2014 Patch Tuesday”

  1. Michael

    Outsource payment portals FTW!

    January 15, 2014 1:16:33, Reply
  2. Chris

    In reply to the question from the Vulnerability Expert Forum January 2014. Has the Target breach caused us to rethink our payment security?
    - We are business to business so it is not applicable. However I think the best defense against the root cause of targeted custom malware would be application control. Lock down what needs to run and do not allow anything else.

    January 15, 2014 1:34:20, Reply
  3. Taylor

    One thing that this has got me thinking about is our internal network and how we have our firewall rules set up. The internal network being that even if one device is setup incorrectly it could increase the risk of an attack on that device and even one device being compromised is not acceptable. The firewall rules need looked into because if I can block any unwanted traffic coming in and prevent traffic from leaving in any other manner than what I specify I can greatly reduce the risk of personal information being stolen. Another tool I’m looking at implementing to improve security is BeyondSaaS. This could be very beneficial to me in that it does all of the scanning from the cloud on a scheduled basis. To begin with it would help to make a very secure network and also if a change was made that potentially exposed us to a threat the reports would alert me of this.

    January 16, 2014 9:59:39, Reply
  4. Ben

    I work for a very large company that, while not directly customer facing, offers many products that companies rely on for their customers. We have certainly taken notice of the issues and are working hard to make sure that the tools and services we offer will not allow something like this to happen to any of the companies we help. In these recent breaches, it is certainly a horrifyingly large number of people that have been impacted, and it will have a negative impact on all of the customers as well as the companies themselves. The only real winners are the hackers. One thing I think this has encouraged us to do is move forward quickly with some innovations that were being rolled out a bit more slowly, especially in the mobile space, to help protect data no matter if it is being stored for payment or something else. If we as an industry can use this to help push forward into a more secure future, we can turn this distressingly large breach into a net positive. Companies need to realize that security does not just happen. It takes hard work and dedication, as well as constant monitoring and adherence to best practices and controls, for security to be as solid as it can be. The hackers are constantly pushing the envelope, and we in the security community need to as well.

    January 17, 2014 1:14:32, Reply
  5. Dan

    This is a two parter: 1st, stopping the attacks will be an ongoing issue such as protecting users machines is now. We patch them, we keep current Anti-Virus and we run Firewalls, IPS and Internet Gateways to help prevent such attacks. 2nd , the only thing that will put a dent in this type of attack is an authenticating credit and debit card system such as EMV. Now, I don’t see part 2 happening anytime soon as it’s too expensive and Banks and Credit card companies find that it’s cheaper to pay the burden of fraudulent charges to customers. In today’s zero liability world, people don’t really care about moving to EMV either, all they have to do is wait for their new card when the credit company discovers fraudulent charges and they pay none of it. Embezzling, larceny and fraud are as old as dirt, it’s a vicious cycle, people like us are the sheriff of Cybertown and I only see the need for more sheriffs in the future. When society starts checking their bank account as much as their Facebook account, then we can start to make a change, until then, just wait for your new card in the mail.

    January 21, 2014 3:21:29, Reply
  6. Taylor

    Some additional things that could help to secure Payment application devices could be things like Organizational Security such as running background checks on all employees that will be using these devices and to perform frequent training sessions to teach employees how to use these devices and also what to watch for to prevent security breaches. When it comes to the people allowed to install and configure point of sale devices only allow certain people that can be trusted and keep good logs of maintenance and what was done. As far as in house applications we need to stay current on the standards and adhere to common software development in payment applications. Also when changes are made to these applications, it is extremely important to check that it still adheres to the standards and guidelines that have been created to prevent data breaches.

    January 22, 2014 1:09:16, Reply

Additional articles

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
Tags:
, , , , ,
BI-5.1-user-asset-visibility-img

Understanding Who Has Access to What with BeyondInsight v5.1

Today, it’s my pleasure to introduce you to BeyondInsight version 5.1, the latest release of our IT Risk Management platform, which unifies several of our solutions for Privileged Account Management and Vulnerability Management. BeyondInsight v5.1 embodies BeyondTrust’s mission to give our customers the visibility they need to make smart decisions and reduce risk to their…

Post by Morey Haber April 15, 2014
Tags:
, , , , , , , , , , , ,

PowerBroker for Unix & Linux Now Available via Web Services

This week BeyondTrust released a fully functional Web Services interface (REST API) for its PowerBroker for Unix & Linux product.  With this new feature users of the solution will now be able to remotely and securely configure and retrieve data via the API.  The Web Services interface implemented by BeyondTrust is an industry standard that…

Post by Paul Harper April 10, 2014
Tags:
, , , , ,