December 2012 Patch Tuesday: Oracle Outside In, TrueType, and more
December’s Patch Tuesday brings us a great collection of vulnerabilities, ranging from Oracle Outside In vulnerabilities within Exchange to TrueType vulnerabilities in every version of Windows. It seems like these are the vulnerabilities that just keep giving. Along with these, other bugs were squashed in Internet Explorer, Microsoft Word, Windows File Handling, DirectPlay, and IP-HTTPS.
The WebReady component in Exchange, which uses Oracle Outside In libraries, has previously seen attention back in August with MS12-058. It is making an appearance again this month in MS12-080. For those unfamiliar with the previous vulnerability, here’s a quick recap. Microsoft uses the Oracle Outside In libraries to parse and display documents in emails. Oracle recently patched a couple of vulnerabilities, which affect components of WebReady, thus making outlook Exchange vulnerable. These vulnerabilities affect the Outside In filters and the HTML Export SDK, which (if properly exploited) could allow an attacker to run code on the Exchange Server in the context of the LocalService account.
The other recurring vulnerability of significance is a TrueType font parsing vulnerability within the Windows Kernel. Stuxnet anyone? Duqu? Yeah, it’s the same type of bug being patched this month in MS12-078. We’ve continually seen TrueType and other font parsing bugs get patched over the past year, since the arrival of state-sponsored malware targeting these types of bugs. This is the most important patch to get rolled out this month, since malicious TrueType fonts can be embedded in documents as well as other mediums. This has been shown to be an effective method of exploitation, so be sure to patch this one immediately.
There is a good combination of vulnerabilities that can be mixed together to provide a good arsenal for client-side attacks. Internet Explorer 9 and 10 are both susceptible to three different vulnerabilities (MS12-077) that attackers can use to execute malicious code on a user’s computer. If the browser attacks don’t appeal to an attacker’s fancy, they still have the option of exploiting a vulnerability in Microsoft Word (MS12-079) that affects versions 2003, 2007, and 2010.
To finish off the month, a number of vulnerabilities were patched in various windows components. MS12-081 addresses a remote code execution vulnerability in the Windows File Handling Component. MS12-082 fixes a heap overflow in DirectPlay, which affects all versions of Windows, except for Windows RT. Lastly, MS12-083 plugs a hole in IP-HTTPS that permits a security feature bypass.
And don’t forget that when you’re doing your holiday shopping, be sure to consider that the new ARM-based tablets running Windows RT are not immune to vulnerabilities. This month marks the third bulletin being released to patch vulnerabilities in RT, fixing the fourth vulnerability since its release.
This December 2012 Patch Tuesday really stands for a good summary of the year in Microsoft vulnerabilities as a whole. At the end of the day, or year as it were, we still continue to see a consistent flow of vulnerabilities affecting everything from client and server applications to privilege escalations and everything in-between. While Microsoft continues to make strides to improve security, we see even their latest and presumably greatest code bases continue to have new vulnerabilities discovered, even within new flagship platforms such as Windows RT and Internet Explorer 10. At the end of the day, I think this December Patch Tuesday is a reminder that Microsoft security can be Scrooge all-year long with the vulnerability gift that keeps on giving even as Microsoft tries to continue to find their security hearts.
Update: You can detect vulnerable systems using Retina and Retina CS, via the following audits:
MS12-077
[17823] Microsoft Internet Explorer Cumulative Security Update (2761465) – IE 9/10
[17824] Microsoft Internet Explorer Cumulative Security Update (2761465) – IE 6/7/8
MS12-078
[17826] Microsoft Windows Kernel Mode Drivers (2783534) – KB2779030
[17827] Microsoft Windows Kernel Mode Drivers (2783534) – KB2753842 XP
[17831] Microsoft Windows Kernel Mode Drivers (2783534) – KB2753842 XP x64/2003
[17832] Microsoft Windows Kernel Mode Drivers (2783534) – KB2753842 Vista/2008
[17833] Microsoft Windows Kernel Mode Drivers (2783534) – KB2753842 7/2008R2
[17834] Microsoft Windows Kernel Mode Drivers (2783534) – KB2753842 8/2012
MS12-079
[17837] Microsoft Word RTF Vulnerability (2780642) – Word 2003
[17838] Microsoft Word RTF Vulnerability (2780642) – Word 2007
[17839] Microsoft Word RTF Vulnerability (2780642) – Word 2010
[17840] Microsoft Word RTF Vulnerability (2780642) – Word Viewer 2003
[17841] Microsoft Word RTF Vulnerability (2780642) – Compatibility Pack
[17842] Microsoft Word RTF Vulnerability (2780642) – Word Automation Services
[17848] Microsoft Word RTF Vulnerability (2780642) – Compatibility Pack x64
[17852] Microsoft Word RTF Vulnerability (2780642) – Office Web Apps 2010
MS12-080
[17835] Microsoft Exchange Multiple Vulnerabilities (2784126) – 2007
[17836] Microsoft Exchange Multiple Vulnerabilities (2784126) – 2010
MS12-081
[17828] Microsoft Windows Filename Vulnerability (2758857)
MS12-082
[17829] Microsoft DirectPlay Heap Overflow (2770660)
[17830] Microsoft DirectPlay Heap Overflow (2770660) – x64
MS12-083
[17825] Microsoft IP-HTTPS Bypass (2765809)
Oracle Gets in the Patch Tuesday Mix
While the entire security world looks to Microsoft on Patch Tuesday, we’re also keeping an eye on other critical technology vendors for their vuln announcements as well. Today, as part of our Patch Tuesday audit update, we’ll also be adding two new audits to our Retina scan engine to close a security vulnerability that can enable an attacker to gain control of an Oracle Database Server (CVE-2012-3132). These audits will be available via both Retina Network Community and the commercial version of Retina Network. More [...]
July VEF Participant Wins a Kindle Fire
As you all know, every month we host our Vulnerability Expert Forum (VEF) webinar. This is a time where our experts share valuable insight regarding new vulnerabilities that are discovered and the actions that need to be taken as a result. It’s a quick way to get up to speed on current potential risks to your organization and a way to explore the impact that high-risk vulnerabilities and exploits have on network environments and infrastructures. BeyondTrust is committed to helping security administrators reduce the workload they face by making this information easily accessible and by clearly presenting all required information to our audience.
June VEF Participant Wins a Kindle Fire
As you all know, every month we host our Vulnerability Expert Forum (VEF) webinar. This is a time where our experts share valuable insight regarding new vulnerabilities that are discovered and the actions that need to be taken as a result. It’s a quick way to get up to speed on current potential risks to your organization and a way to explore the impact that high-risk vulnerabilities and exploits have on network environments and infrastructures. BeyondTrust is committed to helping security administrators reduce the workload they face by making this information easily accessible and by clearly presenting all required information to our audience.
Media RoundUp | Patch Tuesday June 2012
The June 2012 installment of Patch Tuesday was easily one of the most active of the year so far, in terms industry commentary and predictions, driven by the more than two-dozen security vulnerabilities across several of Microsoft’s products. As I’m sure many of you are still catching up on the news, for your convenience I’ve included some of the more insightful coverage from this month’s Patch Tuesday below.
Patch Tuesday June 2012: RDP broken, again. Stuxnet TTF, again.
Overview
This is shaping up to be an interesting Patch Tuesday with critical vulnerabilities being released across a combination of operating system components and client applications. In total there are 7 Microsoft Security Bulletins covering 26 distinct vulnerabilities in this June 2012 Microsoft Patch Tuesday. More than half of these vulnerabilities are rated as being likely to be exploited by Microsoft. On top of all of the vulnerability fixes Microsoft has also added an automatic updater capability for determining if a system has any certificates that are no longer trustworthy. This shows an increasing seriousness at which Microsoft is looking at the variety of certificate related vulnerabilities that have plagued its customers over the last few years.
eEye’s May Patch Tuesday Assessment Now Available On Demand
Miss our live VEF webinar earlier this week? In case you did, I’ve put all of the content together for you below. Enjoy!
Additionally, access this month’s Security Bulletin, a list of all the Audit IDs, and the PDF of the presentation. If you have additional questions you’d like to ask the research team about this month’s Patch Tuesday, please feel free to comment below and we’ll get them answered.
eEye’s Patch Tuesday Assessment Now Available On Demand
Miss our live VEF webinar earlier this week? In case you did, I’ve put all of the content together for you below. Enjoy!
March VEF Participant Wins a Kindle Fire
As you all know, every month we host our Vulnerability Expert Forum (VEF) webinar. This is a time where our experts share valuable insight regarding new vulnerabilities that are discovered and the actions that need to be taken as a result. It’s a quick way to get up to speed on current potential risks to your organization and a way to explore the impact that high-risk vulnerabilities and exploits have on network environments and infrastructures. eEye is committed to helping security administrators reduce the workload they face by making this information easily accessible and by clearly presenting all required information to our audience.
Microsoft Patch Tuesday – April 2012
April is upon us, and for Patch Tuesday Microsoft delivered six security bulletins, patching a total of eleven vulnerabilities. MS12-027 is the most urgent, as Microsoft has rated it critical and has stated that there are targetted attacks leveraging this vulnerability – patch this one first. More [...]
