BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

June 2013 Patch Tuesday

Posted June 11, 2013    BeyondTrust Research Team

It’s halfway through the year and we are seeing the total bulletin count creep just past fifty. This month, Microsoft is providing patches for Internet Explorer, the Windows kernel (and kernel-mode drivers), Windows print spooler components, and Microsoft Office. There are five bulletins in total, comprised of 1 critical (Internet Explorer) bulletin and the remaining 4 important bulletins.

MS13-047 addresses 19 vulnerabilities in Internet Explorer, including 18 generic memory corruption vulnerabilities and one memory corruption caused by a script debugging vulnerability. Four out of these 19 vulnerabilities (CVE-2013-3112, CVE-2013-3113, CVE-2013-3121, and CVE-2013-3142) affect every supported version of Internet Explorer, so attackers will be targeting these vulnerabilities prior to attempting to exploit any of the others. Also, while the script debugging vulnerability grants remote code execution, it will not be a target for attackers, since it requires far more user interaction than a simple drive-by exploit would require. Default Internet Explorer configurations are not vulnerable, since script debugging must be enabled. Attackers will not want to rely on users to correctly start debugging scripts on a web page, so they will be focused on one or more of the memory corruption vulnerabilities. This is the most important bulletin to roll out as soon as possible.

MS13-048 addresses an information disclosure vulnerability within the Windows kernel. This vulnerability only affects 32-bit platforms, meaning that 64-bit, Itanium, and ARM-based platforms, such as Windows RT, are unaffected. This vulnerability occurs when the kernel improperly handles certain system calls that deal with page faults. An attacker that successfully exploits this vulnerability would be able to gain information from the kernel that would be useful when exploiting a secondary vulnerability on the system. The other kernel-related bulletin, MS13-049, fixes an integer overflow vulnerability in the TCP/IP driver, which could result in a denial of service. Unauthenticated attackers can remotely exploit this vulnerability by sending specially crafted TCP connection packets to an affected system, causing the affected system to stop responding. While this may seem trivial, our initial investigation and Microsoft’s own exploitability rating for this vulnerability indicate that this vulnerability is both complex and difficult to exploit. Therefore, it is unlikely to see widespread exploitation of this vulnerability in the near future.

MS13-050 fixes a vulnerability within the print spooler components in Windows. All versions of Windows from Vista and onward are affected, including server core installations. In order to exploit this vulnerability, attackers will need to acquire valid credentials to the target system. This is required because the exploitation vector is to delete a printer connection on the target system, which allows the attacker’s code to run arbitrarily within the context of the System account.

MS13-051 addresses a buffer overflow vulnerability in Microsoft Office 2003 and Office for Mac 2011, which could result in remote code execution. Note that while this vulnerability has not been publicly disclosed, there have been reports of it being used in targeted attacks in the wild. Therefore, it is very important to deploy this patch out as soon as possible.

Be sure to patch Internet Explorer (MS13-047) as soon as possible, along with Microsoft Office (MS13-051), followed by the rest of the patches. Also, be sure to join us for the Vulnerability Expert Forum tomorrow, Wednesday, April 15 at 1pm PT, where we cover these patches, as well as other security news. Sign up here.

Tags:
, , , , , ,

Leave a Reply

Additional articles

webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,
dave-shackleford-headshot

Why You Still Suck at Patching…and How to Turn Your Life Around

Posted March 25, 2015    Dave Shackleford

Live webinar | March 26, 2015 | 10am PT/1pm ET | Dave Shackleford, SANS Instructor | Why You Still Suck at Patching…and How to Turn Your Life Around

Tags:
, ,
infographic

Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls

Posted March 24, 2015    Scott Lang

BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks.

Tags:
,