Microsoft Patch Tuesday Closes Critical Windows, Internet Explorer Security Holes

Microsoft patched more than two dozen security vulnerabilities across several of its products and rolled out a new update feature in response to the Flame attacks in a busy Patch Tuesday.

This month’s security update featured seven bulletins, including three that are rated ‘Critical’ and touch issues related to Internet Explorer, the .NET Framework and the Remote Desktop Protocol (RDP). The other four bulletins are rated ‘important.’

In addition to the bulletins however, Microsoft also released an automatic updater feature for Windows Vista and Windows 7 untrusted certificates. Last week, security researchers discovered fraudulent certificates were used in the Flame attacks to abuse the Windows update mechanism.

“This new automatic updater feature provides a mechanism that allows Windows to specifically flag certificates as untrusted,” Angela Gunn of Microsoft’s Trustworthy Computing Group explained in a blog post. “With this new feature, Windows will check daily for updated information about certificates that are no longer trustworthy. In the past, movement of certificates to the untrusted store required a manual update. This new automatic update mechanism, which relies on a list of untrusted certificates known as a Disallowed Certificate Trust List (CTL), is detailed on the PKI blog.”

Among the bulletins, MS-12-037, which contains 13 security fixes for Internet Explorer, is being regarded by some security researchers as one of the most important to deploy immediately. One of the vulnerabilities it fixes, CVE-2012-1875, is already being used in limited attacks in the wild. The bulletin also fixes CVE-2012-1876, which was used by VUPEN Security during the PWN2OWN contest held early this year at CanSecWest.

“We’re getting our usual, every other month update to Internet Explorer, and as usual it’s the one to patch first,” said Andrew Storms, director of security operations at nCircle. “Microsoft has already seen limited exploits for this bug in the wild. Browser-based bugs are easy pickings for attackers, so don’t delay deploying this patch.”

Another critical bulletin garnering attention is MS12-036, which addresses a vulnerability in Remote Desktop that could enable remote code execution if an attacker sends a sequence of specially-crafted RDP packets to a vulnerable system. RDP is not enabled by default in Windows however, and systems that do not have it enabled are not at risk.

“This relates to MS12-020, which had organizations on high alert in March after Microsoft issued warnings that the vulnerability could be weaponized to result in widespread attacks,” noted Marcus Carey, security researcher at Rapid7. “Up to now, MS12-020 has only been exploited as a reliable denial of service attack; however, from what I understand MS12-036 may offer a more reliable attack vector for exploitation. The silver lining is that after MS12-020, many organizations took preventative measures to disable RDP, especially at egress points in their networks. If organizations must run RDP on the Internet, they should test and deploy MS12-020 patches as soon as possible.”

The final critical bulletin deals with the .NET Framework, and could permit remote code execution if a user views a malicious Webpage using a browser that can run XAML Browser Applications (XBAPs). The vulnerability could also be used by Windows .NET Framework applications to bypass Code Access Security (CAS) restrictions.

In addition to the bulletins, Microsoft also released an advisory regarding a vulnerability in Microsoft XML Core Services 3.0, 4.0, 5.0 and 6.0. According to Microsoft, the issue exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory and ultimately allow an attacker to execute code.   Gunn explained that the investigation into the vulnerability is ongoing, and that the company has released a workaround for anyone who believes they are affected.