This month's patch Tuesday fixes a small set of critical vulnerabilities in a variety of client side software and one "important" server side Forefront UAG data leakage/information disclosure issue. Six bulletins have been created to address eleven exploitable flaws. Three of the six bulletins are top priority and should be addressed ASAP. These are the MS12-023 bulletin, patching a set of five Internet Explorer vulnerabilities leading to remote code execution, and the MS12-027 bulletin, patching the MSCOMCTL ActiveX Control currently receiving some attention as a part of very limited targeted attacks. If they must prioritize deployment, administrators should start their work here. Most folks should have automatic updates enabled and will silently receive the patches, or they can simply navigate their start menu and manually begin the Windows update process.

RCE attacks abusing these six IE and ActiveX vulnerabilities would look like web browser redirections to malicious sites hosting web pages attacking Internet Explorer and emails carrying malicious attachments constructed to appear familiar to the targeted victim. These are currently significant vectors of attack for both consumer/home and corporate Microsoft product users.

Microsoft also is recommending that administrators prioritize the Authenticode flaw and rated it critical, which could be used as a part of targeted attacks. And ActiveX controls can be delivered leveraging this vulnerability, so some distribution vectors may become enhanced. But this flaw allows for additions and modifications to existing code that in turn won't invalidate the existing signature.

A vulnerability exists in the .Net framework, allowing for XBAP applications to be run from the Internet Zone with a prompt. But anytime a decision like that is left to a user, it seems that we have a 50/50 chance of successful exploitation. The remaining vulnerabilty in the Office converter is significant and may result in RCE, but is much less likely to be attacked.

Dangerous, but manageable.

Microsoft is releasing 9 Security Bulletins this month (MS12-008 through MS12-016), patching a total 21 vulnerabilities. Some of these vulnerabilities may enable remote code execution (RCE) in limited circumstances, and offensive security researchers have claimed that a "bug" fixed this month should be client-side remote exploitable, but after months of public circulation, there have been no known working exploits.

The prioritized vulnerabilities patched this month exist in Internet Explorer, a specific version of the C runtime, and .NET framework. The Internet Explorer and .NET framework vulnerabilities may result in a potential drive-by exploits, so consumers and businesses alike should immediately install these patches - mass exploitation is likely to be delivered via COTS exploit packs like Blackhole and its ilk.

S. Korean handlers are slow to take down the publicly distributed malicious code exploiting CVE-2012-0003, a vulnerability patched in Microsoft's January 2012 patch release MS12-004. We have discussed with reporters that the code has been available since the 21st, and a site appears to have been publicly attacking very low numbers of Korean users over the past day or so. The site remains up at this time.

LANDesk Interchange 2011 is winding down in Las Vegas today. The event gathered partners and displayed newer technologies offered by the decade old systems management company. It was interesting hearing from IT "old-timers" that have worked with the technology, describing the company's impact on the industry - its spinoff from Intel, the original LANDesk AV product that wound up in another vendor’s product, and what they like about Kaspersky Lab technologies integration into the security suite. We were happy to present at our partner's conference with "The Dark Side of Unmanaged Desktops", where I described 2011 incidents that both I and our Global Emergency Response Team have investigated and remediated, some incidents in the news, and some of the IT mismanagement issues that enabled these incidents to occur.

In addition to today's Microsoft updates, users of Adobe's Reader and Acrobat software on both Windows and Apple systems need to update their software ASAP. Adobe released Bulletin APSB11-24, addressing at least thirteen memory corruption flaws, and several privilege escalation, logic flaw, and bypass issues.

In today's earlier post about Microsoft's patched vulnerabilities, Excel was highlighted as the target of choice in many targeted attacks. Along those lines, Adobe's Reader and Flash are among the most commonly exploited software applications that are attacked by professional attackers.

Microsoft released 13 bulletins addressing 22 CVE's in its own software: Microsoft Windows, Office, Internet Explorer, .NET and Visual Studio. We'll be watching for Adobe to coordinate any release of their own updates today.

This month's release of 13 bulletins is a sizable one, following up on Microsoft's four bulletin release last month. Everything from Microsoft operating system kernel and networking components to their Microsoft Internet Explorer web browser and development products are impacted to patch information disclosure, denial of service, memory corruption, and elevation of privilege vulnerabilities.

Of the long list, a few appear to be the most severe. All versions of Microsoft's Internet Explorer across mostly all of the Windows operating system are impacted in serious ways. Remote code execution exploits are possible along with information disclosure and less serious denial of service attacks. Microsoft Excel is effected by the manner in which its Windows Data Access Tracing component loads external libraries. An Excel file could be shared on a WebDAV directory along with a maliciously modified library. When it's opened, the library would load and execute on the system at the same privileges as the user that opened the Excel file. For vulnerabilities like these, we will be monitoring for related exploit inclusion in underground market exploit packs like BlackHole, NeoSploit and Phoenix, which is always a bad thing. Visio is also at risk of remote code execution for a second month in a row as attackers serve up modified Visio files. But we won't see its inclusion in the packs because of its low install base numbers.

Four of these Microsoft Security Bulletins patch vulnerabilities that may lead to severe problems like remote code execution, which are often included as a part of client-side drive-by attacks in exploit packs. But this month one of the more interesting vulnerabilities is server-side and may lead to remote code execution on Microsoft DNS servers. This one may be timely because of suggestions that the ongoing progress to DNSSEC implementation will alleviate the problems that the PKI infrastructure has seen related in certificate authorities, a huge subject Moxie Marlinspike addressed at Blackhat last week.

As always, we recommend patching your systems asap. Cheers to a problem free patch Tuesday!

Discussion of this month's patch Tuesday is overshadowed by the massive releases from spearphishing, web and SQLi attacks reported in the media. Four bulletins are being released to address 22 CVE records, or sets of vulnerabilities.

Two of the vulnerabilies immediately enabling remote code execution is the Bluetooth related vuln, however unreliable attacking it may be, and a Visio vuln. A set of vulnerabilities in the CSRSS leading to elevation of privilege and a long set of win32k flaws are impacted.

Microsoft prioritizes deployment of the Bluetooth patch on Vista and Windows 7 client platforms highest. Servers should not be effected. I suppose that in close working environments, it could potentially enable a worm. But the likelihood of another Cabir is low. High value targeted attacks seem to be more of a risk.

The Visio vulnerability was publicly known and PoC released since at least August of last year. Some of our generic detections most likely would have prevented exploitation of this vuln. We are researching for any evidence of related exploitation and will update accordingly.

If you see any problems from the kernel level patches, please comment below, I am interested. Win32k modifications have caused users problems in the past. Cheers to problem free patching!