Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

January 2014 Patch Tuesday

Posted January 14, 2014    BeyondTrust Research Team

Welcome to 2014! This month is a light month for Patch Tuesday bulletins. Microsoft has released patches for Microsoft Word and Office Web Apps, the Windows Kernel (and drivers), and Microsoft Dynamics AX. There are a total of four bulletins addressing six unique vulnerabilities; all of which are rated as important.

The NDProxy zero-day vulnerability from November, CVE-2013-5065, is receiving a fix this month in MS14-002. It affects XP and Server 2003. Attackers have been actively exploiting this vulnerability in the wild. Publicly available exploit frameworks have also incorporated exploits targeting this vulnerability. Given the high availability of exploits for this vulnerability, it is imperative that administrators deploy this patch immediately.

MS14-001, a fix for Microsoft Word and Office Web Apps, patches three vulnerabilities that could lead to remote code execution in the context of the current user. This bulletin covers Word 2003, 2007, 2010, and 2013, Office Web Apps 2010/2013, as well as Word Automation Services on SharePoint Server 2010/2013. Exploitation of this vulnerability would require that a user open a maliciously crafted Word document, which would exploit one of the vulnerabilities. Because this affects so many versions of Word, it is important to get this deployed as soon as possible.

MS14-003 addresses a vulnerability in Windows 7 and Server 2008 R2, affecting Windows kernel drivers. The vulnerability occurs when the driver improperly uses window handle thread-owned objects. Attackers can exploit this vulnerability to gain the ability to execute arbitrary code in the context of the kernel. This is very similar to the vulnerability fixed by MS14-002, which also provides attackers kernel level privileges if properly exploited. Make sure to deploy this patch as soon as possible.

The last patch of the month, MS14-004, fixes a vulnerability in Microsoft Dynamics AX, which could be used to cause a denial of service condition. This privately reported vulnerability affects a few versions of Dynamics AX (4.0 SP2, 2009 SP1, 2012, and 2012 R2). It is caused by a failure to properly handle user input, which could result in the server failing to respond to further client requests. Deploy this patch when possible.

Be sure to patch the NDProxy 0day (MS14-002), Word and Office Web Apps (MS14-001), Windows kernel-mode drivers (MS14-003), and Microsoft Dynamics AX (MS14-004). Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, January 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

>> Hello VEF Attendees! Participate in our monthly giveaway here. Answer the question in the comments to win an iPad Air!

In light of the recent breaches of cardholder data at both Target and Neiman Marcus, we want to know, have you since thought about how to improve or build upon your payment application security?

Why or why not?

Most insightful and/or awesome answer wins!

>> VEF News Articles

NSA Hackers Get the ‘Ungettable’ With Rich Catalog of Custom Tools

Secret contract tied NSA and security industry pioneer

UAE finds US backdoor in satellite

iOS 7 Jailbreak

iOS 7 Jailbreak Security Fail

Major Breach at Target

>> VEF Questions & Comments

Related to the Target breach, Jason mentioned that you can sign up for one free year of credit monitoring through Target, as part of Target’s response to the data breach.

William asked, “…how Target could have prevented the Dexter Malware from scraping the PANS”. After doing some research on Primary Account Numbers (PANs) and card track data in general, there are a number of third party solutions available that provide Point to Point Encryption (P2PE), which can help safeguard payment information. Devices, such as card readers and PIN pads, encrypt card data before it reaches a POS device using Format Preserving Encryption, which allows POS systems to use the encrypted data as if it were card data. Solutions that use P2PE may have stopped the Dexter malware used against Target and other merchants from being effective.

Thank you to all who attended this month’s VEF! We appreciate all the questions and comments. If there was a question you asked that we did not answer on the VEF, or did not mention in this blog post, please contact us directly research@BeyondTrust.comHappy New Year!

, , ,

Leave a Reply

6 Responses to “January 2014 Patch Tuesday”

  1. Michael

    Outsource payment portals FTW!

    January 15, 2014 1:16:33, Reply
  2. Chris

    In reply to the question from the Vulnerability Expert Forum January 2014. Has the Target breach caused us to rethink our payment security?
    – We are business to business so it is not applicable. However I think the best defense against the root cause of targeted custom malware would be application control. Lock down what needs to run and do not allow anything else.

    January 15, 2014 1:34:20, Reply
  3. Taylor

    One thing that this has got me thinking about is our internal network and how we have our firewall rules set up. The internal network being that even if one device is setup incorrectly it could increase the risk of an attack on that device and even one device being compromised is not acceptable. The firewall rules need looked into because if I can block any unwanted traffic coming in and prevent traffic from leaving in any other manner than what I specify I can greatly reduce the risk of personal information being stolen. Another tool I’m looking at implementing to improve security is BeyondSaaS. This could be very beneficial to me in that it does all of the scanning from the cloud on a scheduled basis. To begin with it would help to make a very secure network and also if a change was made that potentially exposed us to a threat the reports would alert me of this.

    January 16, 2014 9:59:39, Reply
  4. Ben

    I work for a very large company that, while not directly customer facing, offers many products that companies rely on for their customers. We have certainly taken notice of the issues and are working hard to make sure that the tools and services we offer will not allow something like this to happen to any of the companies we help. In these recent breaches, it is certainly a horrifyingly large number of people that have been impacted, and it will have a negative impact on all of the customers as well as the companies themselves. The only real winners are the hackers. One thing I think this has encouraged us to do is move forward quickly with some innovations that were being rolled out a bit more slowly, especially in the mobile space, to help protect data no matter if it is being stored for payment or something else. If we as an industry can use this to help push forward into a more secure future, we can turn this distressingly large breach into a net positive. Companies need to realize that security does not just happen. It takes hard work and dedication, as well as constant monitoring and adherence to best practices and controls, for security to be as solid as it can be. The hackers are constantly pushing the envelope, and we in the security community need to as well.

    January 17, 2014 1:14:32, Reply
  5. Dan

    This is a two parter: 1st, stopping the attacks will be an ongoing issue such as protecting users machines is now. We patch them, we keep current Anti-Virus and we run Firewalls, IPS and Internet Gateways to help prevent such attacks. 2nd , the only thing that will put a dent in this type of attack is an authenticating credit and debit card system such as EMV. Now, I don’t see part 2 happening anytime soon as it’s too expensive and Banks and Credit card companies find that it’s cheaper to pay the burden of fraudulent charges to customers. In today’s zero liability world, people don’t really care about moving to EMV either, all they have to do is wait for their new card when the credit company discovers fraudulent charges and they pay none of it. Embezzling, larceny and fraud are as old as dirt, it’s a vicious cycle, people like us are the sheriff of Cybertown and I only see the need for more sheriffs in the future. When society starts checking their bank account as much as their Facebook account, then we can start to make a change, until then, just wait for your new card in the mail.

    January 21, 2014 3:21:29, Reply
  6. Taylor

    Some additional things that could help to secure Payment application devices could be things like Organizational Security such as running background checks on all employees that will be using these devices and to perform frequent training sessions to teach employees how to use these devices and also what to watch for to prevent security breaches. When it comes to the people allowed to install and configure point of sale devices only allow certain people that can be trusted and keep good logs of maintenance and what was done. As far as in house applications we need to stay current on the standards and adhere to common software development in payment applications. Also when changes are made to these applications, it is extremely important to check that it still adheres to the standards and guidelines that have been created to prevent data breaches.

    January 22, 2014 1:09:16, Reply

Additional articles


Scottrade Breach: Identified by Federal Officials

Posted October 5, 2015    Morey Haber

Late afternoon on October 2nd, news leaked out of another large security breach, now at Scottrade. The identity count of records, in the millions again (4.6 million is the latest). This breach comes on the second day of national CyberSecurity month, the first being Experian/T-Mobile breach.

3d image Data Breach issues concept word cloud background

Experian/T-Mobile Data Breach: When 2 Days is not Enough

Posted October 2, 2015    Morey Haber

On October 1, Experian admitted full responsibility for the loss of T-Mobile customer data. 15 million user records dating back to 2013 were effected in the breach, with data including sensitive information that may be decryptable like social security numbers and drivers licenses.


Who Moved My Front Door? (What is Privileged Account Management?)

Posted October 1, 2015    Nigel Hedges

Not too long ago, I was sitting in a room with a very fluffy sales guy. In between words such as “we’ll make this happen” and “leave it with me, I’ll get it sorted” he asked the question “What is Privileged Account Management”?