It’s halfway through the year and we are seeing the total bulletin count creep just past fifty. This month, Microsoft is providing patches for Internet Explorer, the Windows kernel (and kernel-mode drivers), Windows print spooler components, and Microsoft Office. There are five bulletins in total, comprised of 1 critical (Internet Explorer) bulletin and the remaining 4 important bulletins.
MS13-047 addresses 19 vulnerabilities in Internet Explorer, including 18 generic memory corruption vulnerabilities and one memory corruption caused by a script debugging vulnerability. Four out of these 19 vulnerabilities (CVE-2013-3112, CVE-2013-3113, CVE-2013-3121, and CVE-2013-3142) affect every supported version of Internet Explorer, so attackers will be targeting these vulnerabilities prior to attempting to exploit any of the others. Also, while the script debugging vulnerability grants remote code execution, it will not be a target for attackers, since it requires far more user interaction than a simple drive-by exploit would require. Default Internet Explorer configurations are not vulnerable, since script debugging must be enabled. Attackers will not want to rely on users to correctly start debugging scripts on a web page, so they will be focused on one or more of the memory corruption vulnerabilities. This is the most important bulletin to roll out as soon as possible.
MS13-048 addresses an information disclosure vulnerability within the Windows kernel. This vulnerability only affects 32-bit platforms, meaning that 64-bit, Itanium, and ARM-based platforms, such as Windows RT, are unaffected. This vulnerability occurs when the kernel improperly handles certain system calls that deal with page faults. An attacker that successfully exploits this vulnerability would be able to gain information from the kernel that would be useful when exploiting a secondary vulnerability on the system. The other kernel-related bulletin, MS13-049, fixes an integer overflow vulnerability in the TCP/IP driver, which could result in a denial of service. Unauthenticated attackers can remotely exploit this vulnerability by sending specially crafted TCP connection packets to an affected system, causing the affected system to stop responding. While this may seem trivial, our initial investigation and Microsoft’s own exploitability rating for this vulnerability indicate that this vulnerability is both complex and difficult to exploit. Therefore, it is unlikely to see widespread exploitation of this vulnerability in the near future.
MS13-050 fixes a vulnerability within the print spooler components in Windows. All versions of Windows from Vista and onward are affected, including server core installations. In order to exploit this vulnerability, attackers will need to acquire valid credentials to the target system. This is required because the exploitation vector is to delete a printer connection on the target system, which allows the attacker’s code to run arbitrarily within the context of the System account.
MS13-051 addresses a buffer overflow vulnerability in Microsoft Office 2003 and Office for Mac 2011, which could result in remote code execution. Note that while this vulnerability has not been publicly disclosed, there have been reports of it being used in targeted attacks in the wild. Therefore, it is very important to deploy this patch out as soon as possible.
Be sure to patch Internet Explorer (MS13-047) as soon as possible, along with Microsoft Office (MS13-051), followed by the rest of the patches. Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, April 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.