(update: for May 2007 patches click here)
From Eric:
Microsoft has released 5 security bulletins this month. Four of these bulletins are rated Critical by Microsoft, the fifth is rated Important.
Two of this month's vulnerabilities (MS07-018 and MS07-019) are server side vulnerabilities - meaning an attacker can remotely exploit an unpatched system over the Internet. No user interaction is required (like visiting a website or reading an email). Server side vulnerabilities can easily become self-propogating worms, similar to Code Red, Nimda, and Blaster. One of these vulnerabilities is present on Content Management server (which has a low prevalence of installation), and the other is present on all Windows XP systems.
Of the other three vulnerabilities, one is a client side bug (MS07-020) that can be exploited if a user visits an evil website or reads a maliciously formatted email message, and the other two vulnerabilities (MS07-021 and MS07-022) are local privilege escalation attacks that may allow a local user to elevate their permissions and become administrators on their systems.
Shavlik expects to see exploit code released for most, if not all of these issues, in relatively short order. Shavlik recommends deploying all of the related patches to affected systems as soon as possible.
-----------------------------------------------------------------------------
Microsoft Security Bulletin MS07-018
Vulnerabilities in Microsoft Content Management Server Could Allow Remote Code Execution (925939)
All Content Management Server systems are affected, however, the patch is only available for the following releases:
Content Management Server 2001 SP1
Content Management Server 2002 SP2
This is a server-side bug. This means the server can be attacked without requiring any user intervention on the server itself. Any unpatched Content Management Server can be attacked remotely over port 80. Submitting a specific URL to a content management server can allow the attacker to take complete control of the server and execute code of their choice on that server. (This attack may be similar to the attacks performed years ago against unpatched IIS servers where a bug existed in the URL parsing routine of IIS servers, allowing attackers to take over webserves)
Although there are no reports of current attacks using this vulnerability, Shavlik expects exploit code to surface for this attack very soon.
------------------------------------------------------------------------------
Microsoft Security Bulletin MS07-019
Vulnerability in Universal Plug and Play Could Allow Remote Code Execution (931261)
All XP systems are vulnerable, however, the patch is only avaiable for Windows XP SP2
This is a server-side bug for Windows XP, meaning it can be exploited remotely and no user interaction is required on the XP system. Any unpatched XP system can be attacked remotely if the attacker can access UDP port 1900 or TCP port 2869. The attacker could then execute code on that system under the context of LocalService account (which is not quite as good as an admin account)
Customers should block UDP port 1900 and TCP port 2869 with the XP firewall, or they can disable the Universal Plug and Play service.
Although there are no reports of current attacks using this vulnerability, Shavlik expects exploit code to surface for this attack very soon.
-------------------------------------------------------------------------------
Microsoft Security Bulletin MS07-020
Vulnerability in Microsoft Agent Could Allow Remote Code Execution (932168)
This impacts Windows 2000, Windows XP, and Windows Server 2003
This is a client-side bug. The vulnerability can only be exploited if a user of the system visits an evil website or reads a maliciously formatted email message. The attacker who sent the email or hosted the web page could then execute code on the system with the same level of privileges as the logged on user.
As a workaround, customers can disable the Microsoft Agent service or can disable the Microsoft Agent ActiveX control in Internet Explorer.
Microsoft has not seen any reports that this is currently being exploited on the Internet.
---------------------------------------------------------------------
Microsoft Security Bulletin MS07-021
Vulnerabilities in CSRSS Could Allow Remote Code Execution (930178)
This impacts Windows 2000, Windows XP, Windows Server 2003, and Windows Vista
This vulnerability may allow a locally logged on user to elevate their privileges and become administrator on their system. It may also allow customers on shared webservers to execute code on the webserver and become adminitrator over the server and all of the websites.
This vulnerability may also be exploited if a user visits an evil website. The attacker who created the website can then execute code and become administrator on the compromised system
Proof of concept code for this exploit has been posted on the Internet. Shavlik believes that this sample code could be turned into exploit code that could be used by employees who wish to obtain administrative access to their own systems, and systems that they manage. Shavlik also expects to see malicious websites appear that, when visited, would take over the computers of those who visit the site.
--------------------------------------------------------------------
Microsoft Security Bulletin MS07-022
Vulnerability in Windows Kernel Could Allow Elevation of Privilege (931784)
This impacts Windows 2000, Windows XP, and Windows Server 2003
Like the MS07-021 vulnerability, this vulnerability is also a local privilege escalation vulnerability (however, this one is not applicable to Windows Vista)
This vulnerability may allow a locally logged on user to elevate their privileges and become administrator on their system. It may also allow customers on shared webservers to execute code on the webserver and become administrator over the server and all of the websites.
Microsoft has not seen any reports of this vulnerability being exploited on the Internet. Shavlik that exploit code should be available soon that could be used by employees who wish to obtain administrative access to their own systems, and systems that they manage.
