Eleven security fixes from Microsoft

Microsoft's August patch, slated to be the largest patch rollout since 12 bulletins hit users in February of 2007, came up one short of that record with yesterday's release. But Tuesday's release ' covering six critical issues and five important ones ' will still have IT Pros pretty active.

The August release might have equaled the record, except for a "quality issue" on a critical Windows Media Player patch, which got pulled.

"This is actually really interesting this month. By my count we have 11 advisories covering 26 vulnerabilities," said Security Engineer Tyler Reguly of nCircle in San Francisco of the August patch slate. "There were originally supposed to be 12 advisories but it appears as though the Windows Media Player update was pulled. Since this was originally marked critical, it's not good that it's pulled."

Security pros say that the bad thing about Microsoft announcing a patch and then pulling it is that it lets potential hackers know where to look and what to focus on.

"It's like a being given a treasure map that's half completed'there's still a lot of space to cover, but it's significantly smaller than if you had no insight at all, "Reguly added, pointing out that Microsoft appears to be playing catch up by issuing such a large patch slate. "Also, four of the 12 advisories had vulnerabilities that had already been publicly disclosed and one half of those publicly disclosed vulnerabilities are already being actively exploited."

The critical patches address a wide breadth of products and services, from Windows OS versions to applications such as Internet Explorer, Access, Excel and PowerPoint.

For the five important patches, four will affect Windows programs and one will plug vulnerabilities in Microsoft Office. Affected applications are Outlook Express, Windows Mail and Windows Messenger.

All of critical items in this month's patch have remote code execution (RCE) exploit considerations. All fixes but three are designed to stave off RCE bugs. The remaining three address what Redmond calls "information disclosure risk."

"Looks like summer vacation is over a little early for network security professionals. After a light July, the August patch Tuesday will be a very busy one," said Don Leatham, director of solutions and strategy for Scottsdale, Ariz.-based Lumension Security. "The critical updates will affect both desktops and servers, so IT departments will need to quickly and carefully assess which patches should receive priority."

Critical Items

Client-side vulnerabilities continue to be a priority for Microsoft's patch deployment, IT pros say. It's a means for attack that requires attention.

"The five critical patches need to get installed as soon as possible this month," said Jason Miller, security data team manager for St. Paul, Minn.-based Shavlik Technologies. "All of these patches can affect client by attack vectors that are used in day-to-day client-side computer use: visiting an evil Web site or by opening an evil document."

The first critical fix is said to resolve a privately disclosed vulnerability in the Microsoft Image Color Management System. This vulnerability can allow RCE exploits for users with administrative logon credentials. Microsoft's fix for the Image Color Management System affects users of Microsoft Windows 2000, Windows XP Service Packs 2 and 3, and all versions of Windows Server 2003.

Critical fix No. 2 is an across-the-board remedy for all versions of Internet Explorer sitting on every operating system from Microsoft 2000 to Windows XP, Vista and Windows Server 2003 and 2008. The vulnerability involves hackers embedding malicious code through a specially crafted Web page.

The third critical security update resolves a privately reported vulnerability in the ActiveX control for the Snapshot Viewer for Microsoft Access. An attacker could exploit the vulnerability by constructing a specially crafted Web page.

Critical patch four, Microsoft contends, resolves four privately reported vulnerabilities in Microsoft Office Excel that could allow an RCE attack if a user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. This patch is systemic and is a comprehensive patch for Excel on all Windows OS versions.

This security update resolves three privately reported vulnerabilities in PowerPoint and PowerPoint Viewer that could allow remote code execution if a user opens a specially crafted PowerPoint file. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system.

The final critical patch addresses five privately reported vulnerabilities. These vulnerabilities could allow remote code execution if a user viewed a specially crafted image file using Microsoft Office.

Important Patches

The top important item will deal with a privately reported vulnerability in the way certain Windows Internet Protocol Security (IPsec) rules are applied to traffic flow. According to Redmond, the stated vulnerability could cause systems to inadvertently ignore IPsec policies and transmit network traffic in clear readable text, thus disclosing that info to hackers. This is an across-the-board Windows OS patch.

The next important issue remedies a couple of private reported holes in Microsoft Windows Event Systems that could allow remote code execution. Windows Event Systems is a planning application allowing users to map out different types and functions and real world events happening around them while collaborating with other services such as Windows Live Spaces and Windows Live Calendar. Through an RCE exploit, a user could literally and figuratively see what's happening on a system.

Outlook Express and Windows Mail are the targets of information disclosure vulnerabilities for the third important patch on the slate. Redmond said the vulnerability, which was privately reported for the e-mail and scheduling applications, could allow information disclosure if a user visits a specially crafted Web page using Internet Explorer.

The fourth important item is designed to plug a reported vulnerability in supported versions of the Windows Messenger application. A hacker with administrative privileges could carry out an information disclosure exploit through scripting an ActiveX control.

The fifth and final patch for this section is a Microsoft Word patch designed for XP SP3 and Microsoft Office 2003 SP2 and SP3 where RCE exploits are the issue. Hackers could enter the system when users open a maliciously crafted and coded Word file.

Of the 11 patches, six will require restarts.

Tuesday's heavy patch slate comes just two months before Microsoft is shoring up its efforts for greater transparency in the security hotfix space. Beginning with its October patch release rollout cycle, the software giant will provide an assessment of risk for the vulnerabilities outlined in each security bulletin. The aim is to help administrators prioritize patch installation.

Tricking users seemed to be the theme of this month's patch cycle.

"Continuing the ongoing trend, attackers are increasingly targeting common users and tricking them into accessing a malicious Web site or opening an unsolicited document," said Amol Sarwate, manager of vulnerabilities research lab at Qualys. "Today's bulletins mostly deal with user-driven applications, such Microsoft Office including Word, Excel, PowerPoint, Access and others such as Internet Explorer, Outlook Express and Windows Messenger. This is something people need to be aware of, and prioritize more sooner than later."

Since April, Microsoft has asked IT pros to consult a monthly knowledgebase article to find out about new nonsecurity content releases in Windows Update and Windows System Update Services. Junk mail filters, Windows Home Server Power Pack 1 and comprehensive updates for Windows Server 2008, Vista, XP and Windows Server 2003 are on tap this month.