BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

June 2013 Patch Tuesday

Posted June 11, 2013    BeyondTrust Research Team

It’s halfway through the year and we are seeing the total bulletin count creep just past fifty. This month, Microsoft is providing patches for Internet Explorer, the Windows kernel (and kernel-mode drivers), Windows print spooler components, and Microsoft Office. There are five bulletins in total, comprised of 1 critical (Internet Explorer) bulletin and the remaining 4 important bulletins.

MS13-047 addresses 19 vulnerabilities in Internet Explorer, including 18 generic memory corruption vulnerabilities and one memory corruption caused by a script debugging vulnerability. Four out of these 19 vulnerabilities (CVE-2013-3112, CVE-2013-3113, CVE-2013-3121, and CVE-2013-3142) affect every supported version of Internet Explorer, so attackers will be targeting these vulnerabilities prior to attempting to exploit any of the others. Also, while the script debugging vulnerability grants remote code execution, it will not be a target for attackers, since it requires far more user interaction than a simple drive-by exploit would require. Default Internet Explorer configurations are not vulnerable, since script debugging must be enabled. Attackers will not want to rely on users to correctly start debugging scripts on a web page, so they will be focused on one or more of the memory corruption vulnerabilities. This is the most important bulletin to roll out as soon as possible.

MS13-048 addresses an information disclosure vulnerability within the Windows kernel. This vulnerability only affects 32-bit platforms, meaning that 64-bit, Itanium, and ARM-based platforms, such as Windows RT, are unaffected. This vulnerability occurs when the kernel improperly handles certain system calls that deal with page faults. An attacker that successfully exploits this vulnerability would be able to gain information from the kernel that would be useful when exploiting a secondary vulnerability on the system. The other kernel-related bulletin, MS13-049, fixes an integer overflow vulnerability in the TCP/IP driver, which could result in a denial of service. Unauthenticated attackers can remotely exploit this vulnerability by sending specially crafted TCP connection packets to an affected system, causing the affected system to stop responding. While this may seem trivial, our initial investigation and Microsoft’s own exploitability rating for this vulnerability indicate that this vulnerability is both complex and difficult to exploit. Therefore, it is unlikely to see widespread exploitation of this vulnerability in the near future.

MS13-050 fixes a vulnerability within the print spooler components in Windows. All versions of Windows from Vista and onward are affected, including server core installations. In order to exploit this vulnerability, attackers will need to acquire valid credentials to the target system. This is required because the exploitation vector is to delete a printer connection on the target system, which allows the attacker’s code to run arbitrarily within the context of the System account.

MS13-051 addresses a buffer overflow vulnerability in Microsoft Office 2003 and Office for Mac 2011, which could result in remote code execution. Note that while this vulnerability has not been publicly disclosed, there have been reports of it being used in targeted attacks in the wild. Therefore, it is very important to deploy this patch out as soon as possible.

Be sure to patch Internet Explorer (MS13-047) as soon as possible, along with Microsoft Office (MS13-051), followed by the rest of the patches. Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, April 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

Tags:
, , , , , ,

Leave a Reply

Additional articles

ovum-research

New Analyst SWOT Assessment Identifies Key Strengths of PowerBroker

Posted November 24, 2014    Scott Lang

Following on the heels of the Gartner PAM market guide and Frost & Sullivan review of Password Safe comes a new analyst review of our BeyondInsight and PowerBroker platforms, a SWOT assessment of BeyondTrust written by Ovum. Ovum’s honest and thorough review of BeyondTrust indicates that we are delivering, “…an integrated, one-stop approach to PAM….

Tags:
, , ,

Patented Windows privilege management brings you unmatched benefits

Posted November 24, 2014    Scott Lang

We are pleased to announce that BeyondTrust has been granted a new U.S. Patent (No. 8,850,549) for privilege management, validating our approach to helping our customers achieve least privilege in Windows environments. The methods and systems that we employ for controlling access to resources and privileges per process are unique to BeyondTrust PowerBroker for Windows….

Tags:
6

A Quick Look at MS14-068

Posted November 20, 2014    BeyondTrust Research Team

Microsoft recently released an out of band patch for Kerberos.  Taking a look at the Microsoft security bulletin, it seems like there is some kind of issue with Kerberos signatures related to tickets. Further information is available in the Microsoft SRD Blogpost So it looks like there is an issue with PAC signatures.  But what…

Tags:
, , , ,