BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

June 2013 Patch Tuesday

Post by BeyondTrust Research Team June 11, 2013

It’s halfway through the year and we are seeing the total bulletin count creep just past fifty. This month, Microsoft is providing patches for Internet Explorer, the Windows kernel (and kernel-mode drivers), Windows print spooler components, and Microsoft Office. There are five bulletins in total, comprised of 1 critical (Internet Explorer) bulletin and the remaining 4 important bulletins.

MS13-047 addresses 19 vulnerabilities in Internet Explorer, including 18 generic memory corruption vulnerabilities and one memory corruption caused by a script debugging vulnerability. Four out of these 19 vulnerabilities (CVE-2013-3112, CVE-2013-3113, CVE-2013-3121, and CVE-2013-3142) affect every supported version of Internet Explorer, so attackers will be targeting these vulnerabilities prior to attempting to exploit any of the others. Also, while the script debugging vulnerability grants remote code execution, it will not be a target for attackers, since it requires far more user interaction than a simple drive-by exploit would require. Default Internet Explorer configurations are not vulnerable, since script debugging must be enabled. Attackers will not want to rely on users to correctly start debugging scripts on a web page, so they will be focused on one or more of the memory corruption vulnerabilities. This is the most important bulletin to roll out as soon as possible.

MS13-048 addresses an information disclosure vulnerability within the Windows kernel. This vulnerability only affects 32-bit platforms, meaning that 64-bit, Itanium, and ARM-based platforms, such as Windows RT, are unaffected. This vulnerability occurs when the kernel improperly handles certain system calls that deal with page faults. An attacker that successfully exploits this vulnerability would be able to gain information from the kernel that would be useful when exploiting a secondary vulnerability on the system. The other kernel-related bulletin, MS13-049, fixes an integer overflow vulnerability in the TCP/IP driver, which could result in a denial of service. Unauthenticated attackers can remotely exploit this vulnerability by sending specially crafted TCP connection packets to an affected system, causing the affected system to stop responding. While this may seem trivial, our initial investigation and Microsoft’s own exploitability rating for this vulnerability indicate that this vulnerability is both complex and difficult to exploit. Therefore, it is unlikely to see widespread exploitation of this vulnerability in the near future.

MS13-050 fixes a vulnerability within the print spooler components in Windows. All versions of Windows from Vista and onward are affected, including server core installations. In order to exploit this vulnerability, attackers will need to acquire valid credentials to the target system. This is required because the exploitation vector is to delete a printer connection on the target system, which allows the attacker’s code to run arbitrarily within the context of the System account.

MS13-051 addresses a buffer overflow vulnerability in Microsoft Office 2003 and Office for Mac 2011, which could result in remote code execution. Note that while this vulnerability has not been publicly disclosed, there have been reports of it being used in targeted attacks in the wild. Therefore, it is very important to deploy this patch out as soon as possible.

Be sure to patch Internet Explorer (MS13-047) as soon as possible, along with Microsoft Office (MS13-051), followed by the rest of the patches. Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, April 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

Tags:
, , , , , ,

Leave a Reply

Additional articles

smart rules manager for vulnerabilities - v2

A New Way of Looking at Vulnerabilities in Your Environment

Assets, users, vulnerabilities and exploits; all are common themes in my posts on BeyondInsight. With BeyondInsight v5.1, we unveiled a new way to view exploitable assets. Sure, most vulnerability management solutions link vulnerability data to exploit information, allowing tools like NeXpose and QualysGuard to list an asset, its vulnerabilities, and any related exploits. BeyondInsight does…

Post by Morey Haber April 23, 2014
Tags:
, , , , ,
smart rules manager for vulnerabilities

Staying on Top of the Latest Vulnerabilities with BeyondInsight v5.1

It’s no secret that dozens of new OS and application vulnerabilities are revealed every day. Staying on top of these new exposures normally requires paying for services or subscribing to multiple RSS feeds. BeyondInsight 5.1 provides customers with another option: a built-in, customizable vulnerability alerting system that delivers up-to-date information on the latest vulnerabilities in…

Post by Morey Haber April 21, 2014
Tags:
, , , , , ,
BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,