Internet Explorer flaws fixed by Microsoft Patch Tuesday updates

IE vulnerabilities offered hackers a one-two punch, expert says.

Microsoft says Internet Explorer versions 6 through 10 are subjects of two critical Patch Tuesday updates for February that could address recent Java woes.

Both critical patches address vulnerabilities that could give attackers access to client browsers and from there access to the underlying host, says Alex Horan a senior product manager at CORE Security. "Bulletins 1 and 2 target all versions of Internet Explorer on essentially all versions of Windows platforms, so it's pretty much one-hack fits all in the Windows environment for attackers," he says. "I expect a lot of interest in developing a working exploit for this vulnerability."

[NEWS: Microsoft launches campaign against Gmail over privacy

HELP: 11 (FREE!) Microsoft tools to make life easier

NAVIGATE: 12 essential Windows 8 keyboard shortcuts]

Three less urgent patches ranked important could address flaws that enable the takeover of machines accessed via the Internet Explorer vulnerabilities, he says. "Bulletins 7, 8 and 9 seem to target the same underlying systems as Bulletins 1 and 2, which means hackers could phish users and then leverage 7, 8 and 9 to get system level control of their machines. That is essentially a worst case scenario and knockout punch for security personnel," Horan says.

Another security expert Paul Henry, a security and forensic analyst for Lumension, says the two critical Internet Explorer problems could be linked to Java. "It's possible that this is related to the recent and ongoing Java issues," he says. "Microsoft has a very close relationship with Oracle, so it wouldn't surprise me if these bulletins include Java patches."

Regardless, they put unpatched machines in danger of falling to remote code execution exploits, Microsoft says, and may require restarting affected machines, something that will make installing the patches a longer exercise.

There are 12 patches in all this month, an uptick from the past few months, and they affect a wide range of Windows platforms from Windows XP to Windows RT, the new Windows 8 tablet operating system that runs on ARM processors. "It's never a good sign when your current code base is impacted," Henry says. This month's 12 patches is the highest number since June 2011 when there were 16.

One remaining patch ranked important affects the FAST indexing server for SharePoint and is caused by an update to some Oracle libraries used for document conversion by Microsoft, says

The remaining bulletins are all rated important and are mostly "Local Elevation of Privilege" type of vulnerabilities, meaning that one already has to be on the targeted computer to be able to attack them. One exception is Bulletin 5, which can be used for Remote Code Execution. It affects the FAST Indexing server for SharePoint and it is also caused by Oracle's update of the Outside In libraries that are used by Microsoft for document conversion processes, says Wolfgang Kandek, CTO for Qualys.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft Patch Tuesday: Just two critical fixes but they affect a lot of Windows systems

Internet Explorer zero-day exploit is not addressed, but businesses should implement the workaround

Microsoft is issuing two critical fixes on this month's Patch Tuesday, one of them affecting its most popular operating system -- Windows 7 -- in conjunction with Windows Server 2008 R2.

That problem allows remote execution of code on unpatched machines without users doing anything, a situation Microsoft always deems critical.

OTHER PATCH NEWS: VMware patches 'critical' vulnerability

HELP: 15 (FREE!) security tools you should try

The other critical bulletin addresses a vulnerability that affects the full range of Windows desktop operating systems from Windows XP to Windows 8 as well as Windows Server 2003, 2008, 2008 R2 and 2012, and also leaves the systems open to remote code execution. "It is likely that it is a vulnerability in one of the base libraries of Windows that is widely used, such as Windows XML Core Services, which had its last fix in July of 2012," says Qualys CTO Wolfgang Kandek.

While that's a relatively light load in terms of numbers of critical warnings, it doesn't mean it will be easy on IT departments making the patches. "There are a lot of restarts this month and they impact nearly all of the Windows operating systems," says Paul Henry, security and forensic analyst at Lumension, a security, vulnerability and risk management company.

One of the five bulletins designated important - No. 5 - may end up being the most significant in terms of wiping out the threat, says Alex Horan, senior product manager, CORE Security. The problem is located in Vista SP 2, Server 2008 and Windows 7. "This has the potential for the most long-term issues as it represents an extremely large base of potential targets if it is not rectified properly," Horan says.

This includes Windows RT, the new power-pinching version of Windows 8 for devices based on ARM processors, which is affected by the vulnerability addressed by the second of the critical bulletins as well as by three others that are ranked important, Henry notes. Users should get accustomed to it, he says. "The system has been patched a few times already since being released late last year, and we expect to see it included in many of this year's Patch Tuesdays," he says.

None of the bulletins this month directly address a zero-day vulnerability found in the wild over the weekend in fully patched versions of Internet Explorer 6, 7 and 8. The flaw allows attackers to gain control of affected machines. The attack comes from malicious Web sites containing content that exploits the vulnerability in visiting browsers, Microsoft says.

BACKGROUND: Microsoft issues quick fix for critical zero-day hole in IE

The company has issued a workaround but not a patch, and IT departments should make implementing the workaround their top priority, Henry says.
It would have taken a miracle for Microsoft to patch a zero-day one week after a zero-day advisory.
— Andrew Storms, director of security operations for nCircle

It would be surprising if Microsoft had developed the IE patch already, says Andrew Storms, director of security operations for nCircle. "It would have taken a miracle for Microsoft to patch a zero-day one week after a zero-day advisory," he says.

However, it is possible that one of this month's patches will repair operating-system vulnerabilities the IE attack could exploit, says Henry. With the details Microsoft has released so far it's impossible to tell. "If the browser is just a path to an underlying vulnerability in the operating system, then this issue will likely be fixed by one of the patches. If the vulnerability is exclusive to the browser, on the other hand, then this is still something to watch out for," Henry says.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com