Microsoft Patch Tuesday, April 2013

This month we have nine bulletins, two critical coveringjust fourteen CVEs. The critical bulletins are in Internet Explorer and RemoteDesktop Client, two areas we have seen a lot of vulnerabilities. The rest areall rated important. One of those in Windows Defender and one in ActiveDirectory are in areas we haven't seen much activity lately.

One thing to keep in mind is that this month marks one yearleft on support for Windows XP. That means no more security updates or patchesfor those of you still holding on to XP SP3 which is now five years old. (WindowsXP with no service packs is now a teenager.) Some estimates put the installedbase of XP at 40% of all PCs, which seems like an absurdly high number. Theissue for many larger companies seems to be custom built applications that needto be rewritten to work on newer operating systems and outdated hardware, whichin this economy no one wants to pay to update. I guess they can either pay nowto update or pay later when they have lost their intellectual property toattackers or their productivity to downtime as a result of attacks.

MS13-028 (KB2817183)

CRITICAL

Remote Code Execution in Internet Explorer

CVE-2013-1303CVE-2013-1304

As we suspected last week this issue with Internet Exploreris another use-after-free vulnerability where the application continues to usememory after it has been released. In this case an attacker could execute remotecode if they can get a user to view a specially crafted webpage using InternetExplorer.

MS13-029 (KB2828223)

CRITICAL

Remote Code Execution in Remote Desktop Client

CVE-2013-1296

It has been a few months since we have had an RDP vulnerabilitybut I was pretty sure we hadn't seen the last of them. In this case getting auser to visit a specially crafted webpage could result in remote codeexecution. The actual flaw is located in the ActiveX control mstscax.dll, whichattempts to access an object in memory that has been deleted.

MS13-030 (KB2827663)

IMPORTANT

Information Disclosure in Sharepoint

CVE-2013-1290

If an attacker can determined the address or location of aspecific SharePoint list and has gained access to the SharePoint site where thelist is maintained they could gain access to list items that they weren'tsupposed to access. Of course the attacker would still need to authenticate toSharePoint in order to take advantage of this vulnerability. If you have notalready installed the Project Server 2013 cumulative update you should probablydo that first, otherwise Microsoft Update will not offer you this update and ifyou try to download the update manually the download may fail. While thisvulnerability was publicly disclosed Microsoft hasn't seen it being exploitedin the wild, yet.

MS13-0031 (KB2813170)

IMPORTANT

Elevation of Privilege in Windows Kernel

CVE-2013-1284CVE-2013-1294

You don't see race conditions very often in Windows thesedays but this month we have two of them. Both of them deal with how Windowshandles objects in memory, which could allow an attacker to gain elevatedprivileges and read arbitrary amounts of kernel memory if successfullyexploited. In both cases the attacker must be able to log on locally to amachine to take advantage of this flaw. Remember that locally in this caseincludes via Remote Desktop.

MS13-032 (KB2830914)

IMPORTANT

Denial of Service in Active Directory

CVE-2013-1282

If an attacker sends a specially crafted query to theLightweight Directory Access Protocol (LDAP) service they could cause theservice to stop responding resulting in a denial of service. An interesting aspect of this vulnerabilityis that it does not impact Itanium based servers.

MS13-033 (KB2820917)

IMPORTANT

Elevation of Privilege in Windows Client/Server Run-time Subsystem (CSRSS)

CVE-2013-1295

You are probably asking what the hell is the Client/ServerRun-time subsystem? Well, it is the user-mode portion of the Win32 subsystem. Win32.sys is the other part and is thekernel-mode portion. CSRSS is responsible for handling console windows,creating and/or deleting threads, it's an essential subsystem that must berunning at all times. Unfortunately if an attacker has logon credentials to asystem and can run a specially crafted application that would then allow themto delete data or even create new accounts with full user rights.

MS13-034 (KB28223482)

IMPORTANT

Elevation of Privilege in Windows Defender

CVE-2013-0078

Windows Defender is Microsoft's AntiMalware client inWindows 8 and RT. The pathnames it uses could allow an elevation of privilegeto an attacker who is able to successfully exploit this vulnerability. Don't get confused here; the AntiMalwareClient is not updated with the MicrosoftMalware Protection Engine and malware definitions updates so depending on theversion of Windows Defender you have installed you may or may not see thisoffered to you via Microsoft update. If you don't see it offered then youshould try to update manually, most users with up to date software should nothave any issues here. You should definitely install this update as soon as youcan, Microsoft thinks that this vulnerability will be pretty easy to exploitand expects exploit code to be written for this fairly soon.

MS13-035 (KB2821818)

IMPORTANT

Elevation of Privilege in HTML SanitizationComponent

CVE-2013-1289

Who remembers MS12-066? Yeah, didn't think so. It was issuedin October of last year and was very similar to the issue this month. The flawis in the HTML sanitization routines that can impact InfoPath 2010 GrooveServer, Office Web apps and most significantly SharePoint Foundation 2010. Thebad strings could allow cross-site scripting attacks that could run scripts inthe context of the logged-on user resulting in an Elevation of Privilege. Like last October's vulnerability this onewas found in the wild on a limited basis making it doubly important to getthose patches installed quickly.

MS13-036 (KB2829996)

IMPORTANT

Elevation of Privilege in Kernel Mode Drivers

CVE-2013-1283 CVE-2013-1291 CVE-2013-1292 CVE-2013-1293

This one requires that an attacker already have access to asystem, but once they do they can run a specially crafted application toincrease their privilege level. If you are looking in Microsoft Update and you seemultiple updates being offered that is normal, you will need to install themall. There are four different CVEs here, which may account for the multipleupdate packages. Two of them are a race condition, one is a font parsingvulnerability and one is a null pointer deference vulnerability. CVE-2013-1283, one of the race conditions, isalready being exploited to some extent in the wild and CVE-2013-1292, the otherrace condition, looks to be pretty easy to exploit so be sure to apply thispatch as soon as you can.

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.