BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

June 2013 Patch Tuesday

Posted June 11, 2013    BeyondTrust Research Team

It’s halfway through the year and we are seeing the total bulletin count creep just past fifty. This month, Microsoft is providing patches for Internet Explorer, the Windows kernel (and kernel-mode drivers), Windows print spooler components, and Microsoft Office. There are five bulletins in total, comprised of 1 critical (Internet Explorer) bulletin and the remaining 4 important bulletins.

MS13-047 addresses 19 vulnerabilities in Internet Explorer, including 18 generic memory corruption vulnerabilities and one memory corruption caused by a script debugging vulnerability. Four out of these 19 vulnerabilities (CVE-2013-3112, CVE-2013-3113, CVE-2013-3121, and CVE-2013-3142) affect every supported version of Internet Explorer, so attackers will be targeting these vulnerabilities prior to attempting to exploit any of the others. Also, while the script debugging vulnerability grants remote code execution, it will not be a target for attackers, since it requires far more user interaction than a simple drive-by exploit would require. Default Internet Explorer configurations are not vulnerable, since script debugging must be enabled. Attackers will not want to rely on users to correctly start debugging scripts on a web page, so they will be focused on one or more of the memory corruption vulnerabilities. This is the most important bulletin to roll out as soon as possible.

MS13-048 addresses an information disclosure vulnerability within the Windows kernel. This vulnerability only affects 32-bit platforms, meaning that 64-bit, Itanium, and ARM-based platforms, such as Windows RT, are unaffected. This vulnerability occurs when the kernel improperly handles certain system calls that deal with page faults. An attacker that successfully exploits this vulnerability would be able to gain information from the kernel that would be useful when exploiting a secondary vulnerability on the system. The other kernel-related bulletin, MS13-049, fixes an integer overflow vulnerability in the TCP/IP driver, which could result in a denial of service. Unauthenticated attackers can remotely exploit this vulnerability by sending specially crafted TCP connection packets to an affected system, causing the affected system to stop responding. While this may seem trivial, our initial investigation and Microsoft’s own exploitability rating for this vulnerability indicate that this vulnerability is both complex and difficult to exploit. Therefore, it is unlikely to see widespread exploitation of this vulnerability in the near future.

MS13-050 fixes a vulnerability within the print spooler components in Windows. All versions of Windows from Vista and onward are affected, including server core installations. In order to exploit this vulnerability, attackers will need to acquire valid credentials to the target system. This is required because the exploitation vector is to delete a printer connection on the target system, which allows the attacker’s code to run arbitrarily within the context of the System account.

MS13-051 addresses a buffer overflow vulnerability in Microsoft Office 2003 and Office for Mac 2011, which could result in remote code execution. Note that while this vulnerability has not been publicly disclosed, there have been reports of it being used in targeted attacks in the wild. Therefore, it is very important to deploy this patch out as soon as possible.

Be sure to patch Internet Explorer (MS13-047) as soon as possible, along with Microsoft Office (MS13-051), followed by the rest of the patches. Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, April 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

Tags:
, , , , , ,

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,