News

December Microsoft Patch Contains Critical IE Fix

• By Jabulani Leffall
• 12/08/2009

As expected, the last Microsoft Security Update of 2009 will include six security bulletins -- three dubbed "critical" and three labeled "important."

By normal workload standards, things aren't that heavy in this month's slate, which contains fixes for 12 vulnerabilities, according to Wolfgang Kandek, chief technology officer at Qualys. Still, when you add it all up over the year, patch management professionals have been kept busy.

"Microsoft closes 2009 with its last regular patch release adding six bulletins bringing the year's total to 74," Kandek said.

As usual, remote code execution considerations dominate this month's rollout, plus there's one denial-of-service bug to patch.

Critical Patches
The first critical item on the slate is said to fix two bugs, affecting all versions of Windows. Left unpatched, Redmond said the bugs could allow remote code execution if messages "received by the Internet Authentication Service server are copied incorrectly into memory when handling PEAP authentication attempts."

PEAP, or Protected Extensible Authorization Protocol, is a wireless protocol that verifies 802.1X security authentication. The vulnerability could derive from third-party software installed on client systems, according to Jason Miller, data and security team leader at Shavlik Technologies.

"Interesting enough, client systems do not have the vulnerable files on the system as they are not part of the base operating system, but Microsoft is providing a patch for Windows client system," Miller explained. "However, third-party products can be installed on client systems that can be vulnerable."

The second critical item fixes a privately reported vulnerability in Microsoft Project. According to Redmond, the bug could "allow remote code execution if a user opens a specially crafted Project file." This patch touches Microsoft Project 2000, 2002 and 2003.

Critical item No. 3 is where IT pros should be most focused, security experts say. It resolves four privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. Once again, the focus of this IE fix is Microsoft's Active Template Library (ATL).

"IE cumulative updates are generally run-of-the-mill," said Sheldon Malm, senior director of security strategy at Rapid7. "But this month's is the big one with five separate vulnerabilities including ATL. Who knows how long Microsoft has been wrestling with this one…particularly since the CVE reference for ATL clearly precedes the other IE vulnerabilities."

Along with the patch for IE, IT pros will face other high-priority items to patch this month, according to Paul Zimski, vice president of market strategy at Lumension.

"Although there are several critical patches that need to be addressed this month, the big deal for Microsoft patches centers on the ubiquitous [IE patch] affecting all versions of Internet Explorer and carrying Microsoft's highest exploitability rating," Zimski said. "This, combined with subsequent updates issued in Apple's Java for OS X, Adobe's Flash Player and AIR make this month particularly important to shore-up patches and protect against Web-borne malware threats."

Important Patches
The No. 1 important patch on the slate is also the lone security bulletin with denial-of-service implications. The fix resolves a vulnerability that could lock users or administrators out of a Windows system if a remote attacker sends "a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS)" on an affected system.

Under such an attack, the LSASS service can use up all Windows system resources, forcing users to reboot their systems to gain back those resources and make the system responsive once again. This item affects Windows 2000, XP and Windows Server 2003.

The second important item in the December rollout affects Windows Server 2003 and 2008. It addresses a vulnerability in which specially crafted HTTP requests can get sent to a Web server enabled by Active Directory Federation Services.

The third important item addresses a privately reported vulnerability in Windows 2000, XP and Windows Server 2003 associated with Microsoft WordPad and Microsoft Office text converters. Microsoft explained that the bug is triggered when "a specially crafted Word 97 file is opened in WordPad or Microsoft Office Word."

All patches may require a restart.

Those looking for nonsecurity updates via Windows Server Update Services, Windows Update and Microsoft Update can find information in this KnowledgeBase article.