This month we have nine bulletins, two critical covering just fourteen CVEs. The critical bulletins are in Internet Explorer and Remote Desktop Client, two areas we have seen a lot of vulnerabilities. The rest are all rated important. One of those in Windows Defender and one in Active Directory are in areas we haven't seen much activity lately.
One thing to keep in mind is that this month marks one year left on support for Windows XP. That means no more security updates or patches for those of you still holding on to XP SP3 which is now five years old. (WindowsXP with no service packs is now a teenager.) Some estimates put the installed base of XP at 40% of all PCs, which seems like an absurdly high number. The issue for many larger companies seems to be custom built applications that need to be rewritten to work on newer operating systems and outdated hardware, which in this economy no one wants to pay to update. I guess they can either pay now to update or pay later when they have lost their intellectual property to attackers or their productivity to downtime as a result of attacks.
MS13-028 (KB2817183)
CRITICAL
Remote Code Execution in Internet Explorer
CVE-2013-1303CVE-2013-1304
As we suspected last week this issue with Internet Explorer is another use-after-free vulnerability where the application continues to use memory after it has been released. In this case an attacker could execute remote code if they can get a user to view a specially crafted webpage using Internet Explorer.
MS13-029 (KB2828223)
CRITICAL
Remote Code Execution in Remote Desktop Client
CVE-2013-1296
It has been a few months since we have had an RDP vulnerability but I was pretty sure we hadn't seen the last of them. In this case getting a user to visit a specially crafted webpage could result in remote code execution. The actual flaw is located in the ActiveX control mstscax.dll, which attempts to access an object in memory that has been deleted.
MS13-030 (KB2827663)
IMPORTANT
Information Disclosure in SharePoint
CVE-2013-1290
If an attacker can determined the address or location of a specific SharePoint list and has gained access to the SharePoint site where the list is maintained they could gain access to list items that they weren't supposed to access. Of course the attacker would still need to authenticate to SharePoint in order to take advantage of this vulnerability. If you have not already installed the Project Server 2013 cumulative update you should probably do that first, otherwise Microsoft Update will not offer you this update and if you try to download the update manually the download may fail. While this vulnerability was publicly disclosed Microsoft hasn't seen it being exploited in the wild, yet.
MS13-0031 (KB2813170)
IMPORTANT
Elevation of Privilege in Windows Kernel
CVE-2013-1284CVE-2013-1294
You don't see race conditions very often in Windows these days but this month we have two of them. Both of them deal with how Windows handles objects in memory, which could allow an attacker to gain elevated privileges and read arbitrary amounts of kernel memory if successfully exploited. In both cases the attacker must be able to log on locally to a machine to take advantage of this flaw. Remember that locally in this case includes via Remote Desktop.
MS13-032 (KB2830914)
IMPORTANT
Denial of Service in Active Directory
CVE-2013-1282
If an attacker sends a specially crafted query to the Lightweight Directory Access Protocol (LDAP) service they could cause the service to stop responding resulting in a denial of service. An interesting aspect of this vulnerability is that it does not impact Itanium based servers.
MS13-033 (KB2820917)
IMPORTANT
Elevation of Privilege in Windows Client/Server Run-time Subsystem (CSRSS)
CVE-2013-1295
You are probably asking what the hell is the Client/Server Run-time subsystem? Well, it is the user-mode portion of the Win32 subsystem. Win32.sys is the other part and is the kernel-mode portion. CSRSS is responsible for handling console windows, creating and/or deleting threads, it's an essential subsystem that must be running at all times. Unfortunately if an attacker has logon credentials to a system and can run a specially crafted application that would then allow them to delete data or even create new accounts with full user rights.
MS13-034 (KB28223482)
IMPORTANT
Elevation of Privilege in Windows Defender
CVE-2013-0078
Windows Defender is Microsoft's Anti Malware client in Windows 8 and RT. The pathnames it uses could allow an elevation of privilege to an attacker who is able to successfully exploit this vulnerability. Don't get confused here; the Anti Malware Client is not updated with the Microsoft Malware Protection Engine and malware definitions updates so depending on the version of Windows Defender you have installed you may or may not see this offered to you via Microsoft update. If you don't see it offered then you should try to update manually, most users with up to date software should not have any issues here. You should definitely install this update as soon as you can, Microsoft thinks that this vulnerability will be pretty easy to exploit and expects exploit code to be written for this fairly soon.
MS13-035 (KB2821818)
IMPORTANT
Elevation of Privilege in HTML Sanitization Component
CVE-2013-1289
Who remembers MS12-066? Yeah, didn't think so. It was issued in October of last year and was very similar to the issue this month. The flaw is in the HTML sanitization routines that can impact InfoPath 2010 Groove Server, Office Web apps and most significantly SharePoint Foundation 2010. The bad strings could allow cross-site scripting attacks that could run scripts in the context of the logged-on user resulting in an Elevation of Privilege. Like last October's vulnerability this one was found in the wild on a limited basis making it doubly important to get those patches installed quickly.
MS13-036 (KB2829996)
IMPORTANT
Elevation of Privilege in Kernel Mode Drivers
CVE-2013-1283 CVE-2013-1291 CVE-2013-1292 CVE-2013-1293
This one requires that an attacker already have access to asystem, but once they do they can run a specially crafted application toincrease their privilege level. If you are looking in Microsoft Update and you seemultiple updates being offered that is normal, you will need to install themall. There are four different CVEs here, which may account for the multipleupdate packages. Two of them are a race condition, one is a font parsingvulnerability and one is a null pointer deference vulnerability. CVE-2013-1283, one of the race conditions, isalready being exploited to some extent in the wild and CVE-2013-1292, the otherrace condition, looks to be pretty easy to exploit so be sure to apply thispatch as soon as you can.
