Archive for August, 2009

Patch Tuesday Smorgasbord

Microsoft has released 9 bulletins today, 5 of them Critical, 4 of them Important.  The bulletins cover a gamut of affected products – almost everything in your enterprise will need to be patched today with the exception of Internet Explorer.  No IE patches this month!

The majority of bulletin releases these days relate to client-side vulnerabilities – visit an evil website, open an evil document, or read an evil email and you’ll get hacked.  These vulns are of greatest concern on the desktop where end users are filling time between Mafia Wars power-ups and Facebook updates by visiting websites that may be hosting content of questionable repute.  This month, there are 5 bulletins addressing these types of issues.

The remaining 4 bulletins address server-side vulnerabilities.  These are the ones that keep network administrators up at night.  The attacker simply needs network access to the system in question and they can run code of their choice on the server.  This month, there is one flaw that lets anyone with network access own a WINS server, two flaws that let authenticated users own any system, and one flaw that let’s unauthenticated users create a denial of service against some IIS7 webservers. 

I always encourage patching the server-side issues as soon as possible.  Maybe best to form two teams and patch server-side and client-side issues simultaneously.

Now, on to the bulletins.  Starting with the more interesting ones…

MS09-036 is a bulletin that will impact folks running websites on IIS7.  Attackers can send some packets to your webserver and cause it to stop functioning (Denial of Service).  Microsoft has already had some reports that this attack has been spotted on the Internet.  IIS7 websites are safe if they are running in ‘Classic’ mode.  IIS7 sites running in ‘Integrated’ (non-classic) mode are vulnerable.  I’m not exactly sure what the default mode is when setting up an IIS7 website.  The patch for this IIS issue is really a patch .Net Framework versions 2 and 3.  If you’re running IIS7 (classic or otherwise), I’d recommend patching this one soon, unless you want you .asp and .aspx pages to stop functioning.

MS09-037 is a really ugly collection of ActiveX controls that have been patched for the ATL vulnerabilities described in the out of band bulletin MS09-035 from earlier this month.  Microsoft identified 5 ActiveX controls that were using a vulnerable version of the ATL templates.  These ActiveX controls could be executed when visiting evil websites – causing them to execute evil code on your system.  Although Microsoft references a Video Control fix in this bulletin, this is NOT the same ActiveX control that was kill-bitted in MS09-032.

MS09-042 is a Telnet bulletin that is really a throwback to the credential reflection vulnerabilities discussed in MS08-068 (and originally identified back in 201).  This is a variant on the http attack vector discussed in 08-068.  In this instance, the attacker encourages a user to click on a hyperlink where the link is an evil Telnet server.  The evil Telnet server obtains a form of your Windows username and password – they can replay this set of credentials back against your box to login to your system as you – without every knowing your password!  This attack has been publicly known for a long time – so best to patch all of your desktops for this issue before the bad guys start standing up evil Telnet servers. (you may be safe from this attack if you’re on a corporate network that’s blocking inbound NetBIOS ports 139 and 445 – as those are the ports the attacker will most likely try and use to login to your system with the captured credentials).  See for more information on credential reflection attacks.  (IE7 and IE8 disable telnet:// links)

MS09-039 is a Critical issue for network admins managing WINS servers on their Microsoft networks (and every MS network has at least one of these).  This is an unauthenticated server-side attack – the bad guy simply points and shoots some packets at the WINS server and they can execute code of their choice on that server.  This attack is most likely to come from inside your network as the necessary ports to execute the attack are usually blocked at the Internet firewall.  Patch this right away on your WINS servers.

Speaking of the internal network, MS09-041 can be enjoyed internally.  This is a privilege escalation attack against Microsoft systems.  Attackers who have user-level access to machines in the organization (their own machine, file servers, domain controllers, etc) can point some evil packets to their target of choice and execute code.  This vulnerability results from a flaw in the ‘Workstation’ service which is on every machine (and can’t really be disabled without impacting operations on the network).  Patch this one while patching your WINS servers – keep idle internal miscreants from owning your machines.

A less prevalent attack surface in MS09-040 – similar to 09-041 above – but limited to those systems who have installed the MSMQ services (not installed by default).  Attacker can point and shoot packets at the MSMQ service and execute code of their choice.  Like with 09-041, the attacker needs to have valid credentials to the system they’d like to 0wn.

MS09-044 is the last super interesting bulletin this month.  Vulnerabilities in the Remote Desktop Protocol (RDP – formerly known as Terminal Services) can allow attackers to execute code on your desktop should you visit their evil website or visit their evil TermServer.  Two flaws exist, one in the TermServices ActiveX control (which can be launched by visiting an evil website), and one in the RDP console application.  Using the RDP console and visiting an evil TermServer can let the attacker run code on your box.  It’s not a vulnerability in Terminal Services – your remote servers that you access via RDP are safe.  It’s a vulnerability in the client you use to access terminal services.  Patch this one before you go browsing around to evil websites (or trying to break into unknown Terminal Servers).

The last few issues include a bulletin for Office Web Components (09-043) that were being actively exploited since June (visit the evil website and get hacked), and a bulletin for Windows Media Player (MS09-038) where visiting an evil website hosting malformed AVI files could execute code on your system.


Leave a comment »

SANS instructor: “Avoid Adobe… security appears out of control”

Stephen Northcutt, an instructor for SANS and President of SANS Technology Institute, cautions users against using Adobe products due to an increasing number of Adobe security vulnerabilities that have been reported this year.  In the SANS NewsBites Vol 11 #61 (8/4/2009), Stephen says:

“I think organizations should avoid Adobe if possible.  Adobe security appears to be out of control, and using their products seems to put your organization at risk. Try to minimize your attack surface. Limit the use of Adobe products whenever you can.”  (link may not be live yet)

There have been four patches (year to date) in 2009 for Adobe Reader\Acrobat, compared to 3 security patches for Adobe Reader\Acrobat in all of 2008.

Other common desktop applications and their security patch counts since Jan 1, 2009:

8 9 patches for Mozilla Firefox
4 patches for Microsoft Internet Explorer
4 patches for Apple Safari
4 patches for Adobe Reader\Acrobat
3 patches for Adobe Flash
2 patches for Adobe Shockwave
2 patches for Apple Quicktime
2 patches for Apple iTunes

Comments (4) »