Microsoft Releases 6 Critical Patches

• By Jabulani Leffall
• 02/14/08

For the February security bulletin release, Microsoft rolled out six "Critical" fixes--rather than the seven detailed in the advanced notice--and five "Important" items.

This month's 11 patches--said to fix 17 total bugs--are the most Windows IT pros have seen since August, and with a greater variation of vulnerability plugs than at any time in the last 12 months, according to security experts.

"After several slow Patch Tuesdays, administrators are faced with the most patches they've seen in a year," said Paul Zimski, senior director of market strategy at Scottsdale, Ariz.-based Lumension Security. "Because so many critical patches affect so many applications--including Office, Internet Explorer and the operating systems themselves--these are widespread enough to have a bigger effect and they are going to require the utmost attention and energy."

Moreover, Zimski added, with many remote code execution flaws that don't require end user consent, the potential for malware, botnets and rootkits is rampant.

The first critical issue is said to solve what Redmond said was a "privately reported vulnerability" in the Web-based Distributed Authoring and Versioning Mini-Redirector, or WebDAV Mini-Redirector. WebDAV, which enables users to manage Web files on remote servers, is a set of extensions of hypertext protocol most commonly known as "http:." This RCE implication constitutes a hacker's dream in a scenario where attackers can get in and take complete control of a system, manage and edit files and create new accounts with elevated user rights. The issue affects all Windows OS versions with the exception of Windows 2000 SP4.

Critical patch No. 2 also resolves an internally reported hole. It's designed to thwart attacks on Object Linking and Embedding (OLE) Automation, which is a proprietary software feature from Redmond that allows linking to documents, data and other objects on the Windows Component Object Model. For developers, it serves as a way to customize user interfaces. With a specially crafted Web page, an attacker could execute malicious code through OLE but the vulnerability would only really be damaging if it were to affect user workstations that have administrative profile parameters. The fix is for Windows, Office and Visual Basic programs on all OS versions, though only Windows 2000 SP4 and all editions of XP and Vista were labeled as "critical."

Yet another private vulnerability plug is designed to block bad code embedded in specially crafted Word documents. A user could send a Word file, get it opened by an unsuspecting user, and then gain access, going willy-nilly. The vulnerability mainly affects Office SP3, Office XP SP3 and Office 2003 SP2.

The popular browser Internet Explorer was late last year plagued with problems, and now the fourth critical bulletin will hopefully address most of those issues. Specifically, Redmond says this cumulative patch addresses three private bugs and one publicly reported one. Although these fixes--affecting all versions of IE up to and including IE 7 for Vista--are yet to be specified, once that patch is installed what's fixed and not fixed will come out in the rinse, security experts contend.

"These vulnerabilities underscore the importance of having a full security suite to protect consumers and enterprises from being exploited since it's obvious they can no longer only rely on traditional best practices alone, such as avoiding unknown or unexpected e-mail attachments or following Web links from unknown sources," said Ben Greenbaum, senior research manager for Symantec Security Response.

Meanwhile, the fifth critical bulletin affects Microsoft Office Publisher versions 2000 to 2003 and Office XP SP3. The patch resolves two privately reported vulnerabilities in Office Publisher that could allow remote code execution through a specially crafted Publisher file. One such example is an e-mail newsletter than an end user probably shouldn't be opening in the first place.

The last critical issue affects the whole Office suite of applications, most specifically Office 2000 SP3. Office XP SP3, Office 2003 SP2 and Office 2004 for Mac are all noted as "important" in regard to this patch.

While the critical issues will certainly keep a technologist's hands full, there are also five so-called "important" bulletins in this month's rollout.

The first one resolves a privately reported hole that can be exploited during ramp-up of Active Directory on Windows 2000 Server, Windows Server 2003 and Active Directory Application Mode, particularly when installed on Windows XP Professional and Windows Server 2003. This is a denial of service exploit where a hacker simply shuts administrators out of the systems, creating outages, work stoppages and other interruptions. On Windows Server 2003 and XP, however, the hacker would need inside information like local log-on credentials.

The second fix addresses Transmission Control and Internet Protocol processing, more commonly known as TCP/IP. It's a privately reported vulnerability where hackers could force automatic restarts on a looped basis.

The third and fourth important patches affect Windows Internet Information Services (IIS) and are poised to stop elevation of privilege and RCE exploits respectively. In the first case, the attacker would most likely need to have local credentials. Meanwhile, the second one is remote and deals with ASP Web page inputs where an attacker could take control of the IIS server by way of the Worker Process Identity program, which is preset with network admin account privilege defaults--candy for a hacker.

The third patch affects every OS and Windows Server version with the exception of Vista SP1 and the new Windows Server 2008, while the fourth covers XP professional SP2 including the 64-bit editions and all Windows Server 2003 editions.

Security admins should give these two a close look, according to observers.

"The two important patches for IIS warrant attention because Web servers are prime targets compared to an endpoint, and this is definitely not something that you want to be vulnerable," said Lumension's Zimski.

The last of the bunch is an RCE bug unleashed via specially crafted Microsoft Works or .WPS files with an affected version of Office, Microsoft Works or Microsoft Works Suite. The bulletin synopsis says the bug it fixes is more common on Office 2003 SP2 and SP3, as well as Microsoft Works 8.0 and Microsoft Works Suite 2005.

After the sweat is wiped from the brows of those ingesting all this, IT pros should know that of the 11 total bulletins, six will require restarts.

"There were a lot of interesting items," said Eric Schultze, chief technology officer at Shavlik Technologies in St. Paul, Minn. "It's going to be busy but I did notice they pulled the critical JScript\VBScript patch that they had planned. No indication from Microsoft as to why--probably related to last-minute testing failures. Client-side attack vectors will continue, malicious files and Web pages, it's starting to get ho-hum boring. They'll be lots of work, nonetheless."

As a reminder, Microsoft is pushing IE 7 via WSUS automatic update starting today.