Hefty November Patch Adds to IT Woes

• By Jabulani Leffall
• 11/11/09

Microsoft rolled out six security fixes in its November patch Tuesday.

No records were broken, but this patch--with its three "critical" and three "important" bulletins--represents as much as has been seen in past November releases. A hefty patch release may not have been what IT pros wanted to see this month. They may still be reeling from Microsoft's last security release in October, when Microsoft delivered a massive 13 bulletins at once.

Critical Items
The first item in the critical batch of security updates concerns only Vista and Windows Server 2008. The bug affects Web Services on Devices Application Programming Interface (WSDAPI), a product only introduced in Vista but nevertheless relevant to Windows Server 2008.

"It's interesting to note that the bug appears to have been already fixed and released with Windows 7 RTM," said Andrew Storms, director of security at nCircle. "[The patch] is part of Microsoft's broader SDL [security development lifecycle] strategy to ensure bugs are tested and fixed on all supported platforms."

Critical patch No. 2 is designed to stave off exploits that could be triggered if a specially crafted network message to a computer running the License Logging Server were allowed into an enterprise network. The patch affects only Windows 2000.

The third critical item on the slate is said to fix "several privately reported vulnerabilities" in the Windows kernel. If left unpatched, in a worst-case scenario, remote code execution exploits would trigger if a user viewed an Embedded OpenType (EOT) font file. However, hackers would have to lure users to a malicious Web site using this type of font in order for the exploits to trigger, Microsoft explained. This fix touches every Windows OS release except for Windows 7.

This particular patch should be a top priority for IT pros to apply, according to H.D. Moore, chief security officer of Rapid7 and chief architect of the exploit information database Metasploit. Moore recently joined Rapid7 after it acquired Metasploit late last month.

"This is a much greater risk for client side than servers," Moore said. "The EOT font parsing flaw can be used to execute code at the highest possible privilege level, meaning the kernel, directly from Internet Explorer. Standard user-level defenses, like sandboxing, will have no effect on the exploitation of this flaw."

Important Items
Security considerations for Windows Active Directory have been a priority for Microsoft for most of the second half of this year. The first important item in the November patch falls in line with this trend.

This security bulletin addresses Active Directory service, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The fix touches every OS except for Vista and Windows 7.

The second and third important patches are for Microsoft Excel and Word, respectively. They both address XP-based Microsoft Office apps. Affected items include Excel, Excel Viewer for Office 2003, 2007 Microsoft Office System, and Office for Mac 2004 and 2008. The fix for Word applies to Office 2002, Office 2003 for Windows PCs, and Office for Mac 2004 and 2008.

All six patches will require a restart. As it does every month, Microsoft is pointing IT pros and enthusiasts to nonsecurity update information. The November slate of nonsecurity updates is described in this Knowledge Base article. These updates are delivered via Windows Server Update Services, Windows Update and Microsoft Update services.

IT staff may have more than just Microsoft's November patch to tackle as Apple released its 10.6.2 update on Monday.

Some say that Patch Tuesday is quickly becoming "patch everyday," especially with releases from Adobe, Oracle and others joining the Microsoft slate.

"A slew of other vendor patches...is a not-so-subtle reminder that Patch Tuesday is no longer just a Microsoft-only issue," said Paul Henry, security and forensic analyst at Lumension.