News

Microsoft Closes a Record-Patch Year with 17 for December

• By Jabulani Leffall
• 12/14/2010

Windows IT pros this December find themselves unwrapping a huge package of security updates ahead of Christmas directly from Microsoft.
 
Seventeen patches, fixing some 40 vulnerabilities are on the slate this month. Two of the security bulletins are deemed "critical." Following that up are 14 "important" patches to contend with, followed by a lone "moderate" patch.

This massive release caps a historic 2010, with the most collective patches and related vulnerabilities in the history of Redmond's public security updated process known as "Patch Tuesday." The total count after today is 266 total vulnerabilities, with an accompanying 106 patches.

"This leaves IT teams scrambling to respond to the increased general threat level," said Don Leatham, Senior Director of Solutions & Strategies at Lumension. "This busy season of patches and 'hactivism' [via Wikileaks] have spawned an interesting undercurrent of discussion in the security community."
 
As usual, remote code execution (RCE) attacks top the list of considerations, with 10 security bulletins addressing the risk. Other considerations include denial-of-service attacks and elevation-of-privilege concerns. The main products to be patched include Windows, Microsoft Office, SharePoint, Exchange and Internet Explorer.
 
Critical Fixes
First up is a critical security bulletin constituting a cumulative update for IE, the world's most widely used Web browser. The fix affects most versions, including IE 6, 7 and 8.

A cumulative fix for IE may be sorely needed. Verizon researchers recently said they had discovered "a previously undisclosed vulnerability" in the browser that allows attackers to bypass the Protected Mode in both IE 7 and IE 8. Microsoft also faced a holdover issue from last month that was described in this security advisory.

"The most important bug this month is clearly the IE update that includes a fix for the outstanding zero-day bug discovered in early November, said Andrew Storms, Director of Security Operations at nCircle. "With more and more people shopping online this time of year, it's important for everyone to patch their browsers."

Storms added that the patch appears to fix the final bug related to Stuxnet, a pervasive worm that worked its way into some of the most important networks around the globe.

The second and final critical item resolves what Microsoft describes as several privately reported vulnerabilities in the Windows Open Type Font (OTF) driver that could allow remote code execution. The Windows patch touches every supported Windows operating system.

Important and Moderate Fixes
The first five patches of a total of 14 important security bulletins deal with Windows components that require a network folder or corrupt file as a mode of incursion.

First up is a patch for Windows Task Scheduler followed by an important patch that touches several versions of Windows Movie Maker. The fixed flaw is only triggered by specially crafted files residing on the same network and used during a Movie Maker session.

 The same can be said for important patch No. 3, which could allow remote code execution if an attacker convinces a user to open a legitimate Windows Media Profile that would, again be located on the same network.

 Moving right along, file suffix types such as "eml" and ".rss" for Windows Live Mail or "wpost" for Microsoft Live Writer are the vector for the fourth important patch. Such specially crafted binary files, according to Microsoft, would need to be housed in same network folder for the attack to work.

 The Internet Connection Signup Wizard of Microsoft Windows is the vector for the fifth important patch.

Important patch No. 6 tackles vulnerabilities in Windows Kernel-Mode Drivers, while the seventh important patch looks at a hole in the routing and remote access (NDProxy) component of Microsoft Windows.

Consent User Interface and Netlogon remote call procedure (RPC) Service on affected versions of Windows Server are the issues affecting the eighth and ninth important patches respectively. The latter patch, with Netlogon hinges on Windows Server versions configured as domain controllers.

Further still, a security update resolving a privately reported vulnerability in Windows Server 2008 Hyper-V and Windows Server 2008 R2 Hyper-V is the order of the day for important patch No. 10.

Next up is a fix for Microsoft Publisher, the eleventh patch on this long slate of fixes. SharePoint and Microsoft Office Graphics Filter vulnerabilities comprise the remaining.

A fix for Microsoft Exchange Server is the lone moderate patch.

All patches may require a restart.

 In that vein, with the largest patch release ever, security expert Jason Miller of Shavlik Technologies has some advice:  "This is the time of the year where maintenance windows may be tight due to the holidays, vacations and office closures," said Miller, data and security team leader for Shavlik. "With [this many] bulletins, take the time to thoroughly review each bulletin and identify which bulletins require your immediate attention."

For those with any time left at all, Microsoft will be rolling out non-security updates via its Windows Server Update Services (WSUS), Windows Update and Microsoft Update services. Details about those updates can be found here.