September security patch addresses Windows and Office flaws

IT pros can now get their hands on nine fixes for Windows systems, addressing 11 vulnerabilities.

Microsoft released its September patch today containing four "critical" items to fix plus five "important" bulletins. Seven of the security bulletins aim to address remote code execution (RCE) risks and two are designed to ward off elevation-of-privilege issues.

These nine fixes mostly plug vulnerabilities to remote procedure calls (RPCs) in Windows networks. IT pros should test before rolling out the fixes, according to Jason Miller, data and security team manager at Shavlik Technologies.

"[This month], it is especially important for IT administrators to read these bulletins carefully and determine how they affect their individual environments as today's bulletins apply to special configurations," Miller said.

Critical Fixes

The first critical item is designed to fix a print-spool flaw. This vulnerability, according to Microsoft, "could allow remote code execution if an attacker sends a specially crafted print request to a vulnerable system." Essentially, the print spooler interface can be exposed to an RPC.

This critical fix addresses every supported Windows OS. It's the top item to patch this month, according to Joshua Talbot, security intelligence manager at Symantec Security Response.

"The most dangerous vulnerability is the Print Spooler service impersonation issue," Talbot said. "This vulnerability has been identified by Symantec as one of the attack vectors built into the notorious Stuxnet threat, which targets industrial control systems. This is evidence the vulnerability is already being exploited in the wild."

Critical fix No. 2 resolves a privately reported vulnerability in the MPEG-4 codec. The vulnerability could allow remote code execution if a user opens a specially crafted media file or "receives specially crafted streaming content from a Web site," Microsoft explained. This fix affects every supported Windows OS except Windows 7 and Windows Server 2008.

The third critical bulletin pertains to a bug in the Windows OS Unicode Scripts Processor (USP). The USP is a set of services for rendering complex text layout in the Windows Dynamic Link Library (DLL). The patch is for Microsoft Office XP Service Pack 3, Microsoft Office 2003 Service Pack 3 and Microsoft Office 2007 Service Pack 2.

The fourth and final critical fix will also be an Office fix and will affect the same versions described above. It specifically involves the Microsoft Outlook e-mail program. The fix is designed to plug a vulnerability that can be triggered by a specially crafted e-mail message in Microsoft Outlook linked to an Exchange server with Online Mode.

Important Fixes

The first important fix on this month's patch slate is associated with Internet Information Services (IIS). The fix covers every supported Windows OS. Andrew Storms, director of security at nCircle, said hosting providers using IIS servers with PHP will want to pay particular attention to this important fix.

"The vulnerability specifically affects IIS servers with third-party scripting technologies where FastCGI is enabled," Storms said. "Large hosting providers in particular will be a specific target until they can get all their systems patched and rebooted, and that will definitely take some time. Hosting providers will want all hands on deck to get this patch out as quickly as possible."

The second important fix is for WordPad text converter applications sitting on all supported editions of Windows XP and Windows Server 2003, Vista and Windows Server 2008.

Active Directory, Active Directory Application Mode and Active Directory Lightweight Directory Service are the Windows components affected by important fix No. 3, which covers Windows XP and Windows Server 2003.

The fourth important fix addresses an elevation-of-privilege vulnerability in the Local Security Authority Subsystem Service.

The fifth and last important fix in the September patch rollout affects Windows XP and Windows Server 2003. It deals with the Windows Client/Server Runtime Subsystem. This patch is specific to Asia mostly, or to server runtime subsystem components configured for "Chinese, Japanese, or Korean system locale," according to Microsoft.

A restart may be required after applying the fixes in this month's security rollout.

On top of the September patch, Microsoft released two security advisories this month. Security Advisory 2401593 concerns an elevation-of-privilege issue that could affect Exchange customers using Outlook Web Access. The updated Security Advisory 973811 introduces "extended protection for authentication" for Windows systems. Microsoft said it is encouraging "customers to review both security advisories for details on mitigations and workarounds."

Windows IT pros with spare time this month can check out this Knowledge Base article for nonsecurity updates rolled out through Windows Server Update Services, Windows Update and Microsoft Update services.