Captain's Blog

New Patches

Update:

Here is a good overview of patch day from Bill Sisk at SearchSecurity.  One very big key, and I noted this below in regards to MBSA already:  "Most of the affected products in this particular bulletin are not detected by Microsoft Baseline Security Analyzer (MBSA) 2.0.1. However, Microsoft has worked with Shavlik Technologies to provide support for legacy security update detection. Please refer to the main MBSA website for additional information."  Or you can just to go http://www.shavlik.com/pDownloadForm4.aspx and get trial of our s/w to scan for these patches (and buy our product of course)

Microsoft has released four critical security bulletins this month, all in Office.  Sometimes Office is hard to patch with Altirus and SMS so be sure to use patching products (!) and be aware that tools like MBSA do not even do remote scans for Office patches (MBSA is not really a scanner tany more anyway but that is a different topic)

MS08-014: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029)

Severity: Critical

http://www.microsoft.com/technet/security/bulletin/MS08-014.mspx

MS08-015: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (949031)

Severity: Critical

http://www.microsoft.com/technet/security/bulletin/MS08-015.mspx

MS08-016: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)

Severity: Critical

http://www.microsoft.com/technet/security/bulletin/MS08-016.mspx

MS08-017: Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (933103)

Severity: Critical

http://www.microsoft.com/technet/security/bulletin/MS08-017.mspx

Cancel Patch Tuesday?

Modern patch management products can patch about 1000 computers per hour via one person without requiring setup such as an agent, or if you are already using an agent that works too.  Products like SMS, Altirus and others are likely to take longer when unsupported products need to be patched as packages will need to be hand built and detection does not work, but again focused patching products take care of all this so its not really a problem, at least for those using them.

So -- with the right products now available could Microsoft now release patches as they exit test to shrink the vuln. window? Is it worth it?  What about known vulns that MS does not patch for months, this problem would not go away.  Its an interesting thought.

Dennis Fisher mentions a new way to look at Patch Tuesday (actually the old way as he notes)

Instead of leaving flaws unpatched for weeks between cycles, Microsoft should use its resources to produce high-quality patches shortly after vulnerabilities are discovered.

...

Patch Tuesday is perhaps the most anticipated and feared day of the month for network administrators and security managers. They wait eagerly for the next batch of patches from Redmond, glad to have some protection against attacks on the vulnerabilities that have popped up since the previous month's release. But they dread it too, and with good reason, given the massive amount of work involved in rolling out a dozen or more patches to thousands of systems.

Microsoft Recommends Shavlik

Its pretty well known that we have been working on patch management for a long time, creating MBSA and now providing Shavlik NetChk Limted, which is directly recommended by Microsoft.  We are focused helping assure our customer's and the industry in general are getting strong security support. Our on going relationship with Microsoft is key to this.

Here are some related links:

Microsoft

Legacy Product Support: For customers using legacy products not supported by MBSA 2.0.1, Microsoft Update, and WSUS, Shavlik Technologies provides a free MBSA 2.0.1 companion tool called Shavlik NetChk Limited.

Users who have the following products in their environment can use Shavlik NetChk Limited to augment MBSA 2.0.1 results for comprehensive security update detection.

•	Office 2000
•	ISA Server 2000
•	FrontPage Server Extensions 2000/2002
•	Visual Studio .Net 2002/2003
•	SQL Server 7.0/2000
•	Other products not included in Microsoft Update's supported product list

WindowsITPro

"Shavlik Technologies was an easy choice for Microsoft to go to for providing continuity in supporting [complete security scanning] for customers who are using some of the older products," said Stephen Toulouse, Group Program Manager at Microsoft. "Shavlik has an intimate knowledge of security detection requirements since they helped develop the first version of MBSA for Microsoft."

Redmond Mag

ENT

Shavlik's NetChk Protect Limited searches for critical  security patches and spyware. However, the free version does not install patches  or remove spyware, according to the product's Quick Start Guide posted on  Shavlik's Web site. 

Get this free product, without any registration or timeous here.

Banner year for patches

News.Com notes:

Last year, researchers at Internet Security Systems identified 5,195 vulnerabilities in software. On Monday, the count for this year stood at 5,450, according to the Atlanta-based company's survey, and the projected total for the whole of the year is almost 7,500 bugs.

Patch management is well beyond a Microsoft only problem...

Patch Tuesday

Microsoft has released 10 new security bulletins today. Shavlik is currently testing these patches and will release updated XML files shortly.

Microsoft Security Bulletin MS06-056

Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure (922770)

http://www.microsoft.com/technet/security/bulletin/ms06-056.mspx

Severity: Moderate

Microsoft Security Bulletin MS06-057

Vulnerability in Windows Explorer Could Allow Remote Execution (923191)

http://www.microsoft.com/technet/security/bulletin/ms06-057.mspx

Severity: Critical

Microsoft Security Bulletin MS06-058

Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (924163)

http://www.microsoft.com/technet/security/bulletin/ms06-058.mspx

Severity: Critical

Microsoft Security Bulletin MS06-059

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (924164)

http://www.microsoft.com/technet/security/bulletin/ms06-059.mspx

Severity: Critical

Microsoft Security Bulletin MS06-060

Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (924554)

http://www.microsoft.com/technet/security/bulletin/ms06-060.mspx

Severity: Critical

Microsoft Security Bulletin MS06-061

Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (924191)

http://www.microsoft.com/technet/security/bulletin/ms06-061.mspx

Severity: Critical

Microsoft Security Bulletin MS06-062

Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922581)

http://www.microsoft.com/technet/security/bulletin/ms06-062.mspx

Severity: Critical

Microsoft Security Bulletin MS06-063

Vulnerability in Server Service Could Allow Denial of Service (923414)

http://www.microsoft.com/technet/security/bulletin/ms06-063.mspx

Severity: Important

Microsoft Security Bulletin MS06-064

Vulnerabilities in TCP/IP IPv6 Could Allow Denial of Service (922819)

http://www.microsoft.com/technet/security/bulletin/ms06-064.mspx

Severity: Low

Microsoft Security Bulletin MS06-065

Vulnerability in Windows Object Packager Could Allow Remote Execution (924496)

http://www.microsoft.com/technet/security/bulletin/ms06-065.mspx

Severity: Moderate

- The Shavlik XML Team

More Sept Patch Details

From the Shavlik data team:

Microsoft has released three new security bulletins today, and they have also re-released patches for two prior security issues.

The re-release of MS06-042 is the most important item and should be installed as soon as possible*.

MS06-052 is a security patch for Windows XP. It is rated Important by Microsoft, but it allows an attacker to take complete control over an affected computer. Fortunately, most computers won't be at risk from this issue, because the vulnerability is only present if Microsoft Message Queueing Services (MSMQ) is installed. MSMQ is not installed by default, so it won't be present on most computers. Home users won't have MSMQ installed, this is only a concern for specific business users with MSMQ installed. Shavlik believe this is a signficant vulnerability for people who have MSMQ installed, however we haven't seen any attacks on the Internet that exploit this issue at this time. Apply this patch to MSMQ systems within the next four weeks.

MS06-053 is a security patch for Windows 2000, Windows XP and Windows Server 2003 that is rated Moderate by Microsoft. This issue only impacts people who run the Microsoft IIS web server on their computer, and they browse the Internet from this same computer. If you don't have IIS installed, then this isn't an issue. If you do have IIS installed and you visit an evil website, the evil website may be able to glean certain pieces of information about your computer, however, it won't be able to remotely attack or logon to your computer. Shavlik believes this is a fairly low-risk limited attack scenario. Apply this patch at your convenience.

MS06-054 is a patch for Microsoft Publisher (versions 2000, 2002, and 2003) and is rated Critical by Microsoft. If a user opens an evil Publisher document, the user's system may be compromised. As a result, the users system may be reformatted, or trojan code can be installed on the computer, or the users data may be stolen from this system. Users who log on to their computer with Admin rights are more at risk from this issue than users who logon as a User level account. By default, most home users and many corporate users are running with Admin permissions on their computer, so they would be more at risk from this issue. Users who do not have Publisher installed on their computers are not at risk. Shavlik believes this is a medium risk issue for people who use Publisher on their computers. Shavlik does not rate this as a high risk because it cannot be used to automatically hack into servers or other computers unless a user on that machine specifically downloads and opens an evil Publisher document. Shavlik is not aware of any exploits on the Internet for this issue.

Microsoft re-released a patch for MS06-040 that fixed a problem that would crash Windows Server 2003 systems where MS06-040 was installed and other applications, such as Microsoft Navision were running. MS06-040 is a Critical patch that fixed a remotely exploitable flaw in the Operating System. The original version of this patch crashed Windows Server 2003 systems running programs like Navision, however, the patch was Critical to install and therefore users had to deal with the consequences. Shavlik believes that this re-release fixes the issue, however, it points to a lack of complete testing at Microsoft, particularly testing with Microsoft's own business applications, that led to this original problem.

* Microsoft also re-released MS06-042 - a Critical patch for Internet Explorer. This patch had already been re-released once for some systems. This is the third version of the patch and it aims to correct a security flaw that was introduced by the first two versions of this patch. A user who has either the first or second version of 06-040 installed may get hacked if they visit an evil website with Internet Explorer. The evil website could take complete control of the user's computer, including reformatting the hard drive, installing trojans and worms, or stealing sensitive information from the hard drive. This is one of the first times that a Microsoft security patch has introduced a new security vulnerability - leaving customers in a 'darned if you do and darned if you don't' position. Shavlik believes the third version of the patch corrects all of these issues and should be installed as soon as possible.

Sept Patch Day

From the Patch Team: (Mark: we are testing these patches on over 300 configurations via our automated system - this takes a bit of time, measured in hours - and when its done we will  update our servers with new XML that enables the management these patches.  We test for 26 languages also - all today - so everyone gets access as fast as possible)

Microsoft has released three new security bulletins and has re-released patches associated with two prior security bulletins

MS06-052

Vulnerability in Pragmatic General Multicast (PGM) Could Allow Remote Code Execution (919007)

Severity: Important

http://www.microsoft.com/technet/security/Bulletin/MS06-052.mspx

MS06-053

Vulnerability in Indexing Service Could Allow Cross-Site Scripting

(920685)

Severity: Moderate

http://www.microsoft.com/technet/security/Bulletin/MS06-053.mspx

MS06-054

Vulnerability in Microsoft Publisher Could Allow Remote Code Execution

(910729)

Severity: Critical

http://www.microsoft.com/technet/security/Bulletin/MS06-054.mspx

Re-releases:

MS06-040 has been re-released for Windows 2003 SP1

http://www.microsoft.com/technet/security/Bulletin/MS06-040.mspx

MS06-042 has been re-released for IE 5.01 SP4, IE6 SP1 on Win2K and XP, and IE 6 on Windows Server 2003

http://www.microsoft.com/technet/security/Bulletin/MS06-042.mspx

New Spyware and MS06-042 updated

From Microsoft in regards to MS06-42. Please note that Shavlik customers were not effected by the SMS problems listed by Microsoft since all Shavlik products have all the latest engines . SMS customers can upgrade to our engines if they wish.  SMS uses very old Shavlik engines.

In other news... here are more sigs from our data team

Version 5.6
XML Date:  8/24/2006
XML Version:  1.0.2.1378
XML Object Count:  98,572

 

Version 5.5
XML Date:  8/24/2006
XML Version:  1.0.2.1380
XML Object Count:  98,215

 

Added Crawlws
Added ProvenTactics
Added RegiFast
Added SearchForIt
Added SearchEssistant
Added new version of TargetSaver
Updated CoolWebSearch.D
Updated ISTBar
Updated PhaZeBar
Updated 2020Search

Shavlik Survey (SSL Based)

I wrote up a survey at https://www.surveymonkey.com/s.asp?u=394252488617

Please take 5 minutes to answer a few questions if you have the time.  It really helps us build the right products and company for you.

The survey is SSL encrypted and you do not need to give us your name etc unless you want to.

I will post results once there is some solid data.

Thank you,
Mark

 

August Patch Details

From Eric Schultze, our patch expert:

Looks like MS06-040, MS06-041, MS06-042 are most "dangerous" in sense that they might be "wormable" in combination. Exploit code exists in the wild for MS06-040 - so this is the one that might be most important to install first.  Although of these 12 bulletins, I'd say 9 or 10 of them are "very high priority" for testing and deployment ASAP. (Least concerned about MS06-044, MS06-045, MS06-049)

(** means exploit code exists for this issue)

** MS06-040 - Remote buffer overflow in Server Service.  Exploit code exists in the wild for this issue - improtant to patch this one right away.  Server service provides file an printer sharing and logon services to both workstations and servers. Only known workaround is to block ports 139 and 445. All Operating Systems at risk, although Windows 2000 systems may be most at risk.  Different vuln than in MS06-035 (both must be installed to fully protect)

MS06-041 - DNS - Requires user to load/preview specially crafted email/website. Registry modification workaround is available in the security bulletin. This attack will only work on the local subnet. Potential worm combination. Affects all Windows releases.

** MS06-042 - IE rollup - fixes 7 vulns total of which 4 remotely exploitable - 1 publicly disclosed with proof of concept code. Will probably become a major spyware vector. Affects all supported IE versions.

** MS06-043 - Outlook Express 6/MHTML parse error - In order to be exploited, a user must view a malicious web page or read an evil html-formatted email. Publicly reported.  Proof of concept code has been released.

MS06-044 - MMC embedded HTML parse error - Affects Windows 2000 only. IE6 SP1 lessens impact - In order to be exploited, a user must view a malicious web page or read an evil html-formatted email

MS06-045 - This is a bug in drag and drop event handling.  This is rated important and impacts all Operating Systems.  As a workaround, you can disable WebDAV to eliminate vuln until patch is applied. Requires user to OK several post-exploit actions in order to exploit a system

MS06-046 - This is a vulnerability in Active X HTML help control.  As a workaround, you can disable HTML help, prompt for ActiveX.  In order to be exploited, a user must view a malicious web page or read an evil html-formatted email.  This exploit has been publicly disclosed, though no proof of concept code has been released at this time.

** MS06-047 - Visual Basic for Apps - Affects Office XP and Office 2000 and related components.  In order to be exploited, a user must open a malicious Office document.  This issue has been publicly disclosed and is being actively exploited on the Internet.

** MS06-048 - PowerPoint  This issue affects Powerpoint 2000, XP, 2003 + Mac.  In order to be exploited, a user must open a malicious Office document.  This issue has been publicly disclosed and is being actively exploited on the Internet.

MS06-049 - Kernel issue.  This impacts Windows 2000 only.  Attacker must log on to the system in order to exploit this issue.  This is a privilege escalation vulnerability where a user may elevate their permissions to that of administrator.

MS06-050 - Hyperlink Object Library.  This affects all Operating Systems.  A user must click malicious link in order to be exploited.  As a workaround, you can disable hyperlink clicking via registry (though this may confuse users)

MS06-051 - remote kernel exploit.  This affects all Operating Systems. 2 vulns - User profile elevation only affects Windows 2000 and requires the attacker to logon to the system. The second issue is an unhandled exception and requires user to visit malicious web site