Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Microsoft Patch Tuesday, April 2013

This month we have nine bulletins, two critical covering just fourteen CVEs. The critical bulletins are in Internet Explorer and Remote Desktop Client, two areas we have seen a lot of vulnerabilities. The rest are all rated important. One of those in Windows Defender and one in Active Directory are in areas we haven't seen much activity lately.

One thing to keep in mind is that this month marks one year left on support for Windows XP. That means no more security updates or patches for those of you still holding on to XP SP3 which is now five years old. (WindowsXP with no service packs is now a teenager.) Some estimates put the installed base of XP at 40% of all PCs, which seems like an absurdly high number. The issue for many larger companies seems to be custom built applications that need to be rewritten to work on newer operating systems and outdated hardware, which in this economy no one wants to pay to update. I guess they can either pay now to update or pay later when they have lost their intellectual property to attackers or their productivity to downtime as a result of attacks.

 

 

MS13-028 (KB2817183)

CRITICAL

Remote Code Execution in Internet Explorer

CVE-2013-1303CVE-2013-1304

As we suspected last week this issue with Internet Explorer is another use-after-free vulnerability where the application continues to use memory after it has been released. In this case an attacker could execute remote code if they can get a user to view a specially crafted webpage using Internet Explorer.

 

MS13-029 (KB2828223)

CRITICAL

Remote Code Execution in Remote Desktop Client

CVE-2013-1296

It has been a few months since we have had an RDP vulnerability but I was pretty sure we hadn't seen the last of them. In this case getting a user to visit a specially crafted webpage could result in remote code execution. The actual flaw is located in the ActiveX control mstscax.dll, which attempts to access an object in memory that has been deleted.

 

MS13-030 (KB2827663)

IMPORTANT

Information Disclosure in SharePoint

CVE-2013-1290

If an attacker can determined the address or location of a specific SharePoint list and has gained access to the SharePoint site where the list is maintained they could gain access to list items that they weren't supposed to access. Of course the attacker would still need to authenticate to SharePoint in order to take advantage of this vulnerability. If you have not already installed the Project Server 2013 cumulative update you should probably do that first, otherwise Microsoft Update will not offer you this update and if you try to download the update manually the download may fail. While this vulnerability was publicly disclosed Microsoft hasn't seen it being exploited in the wild, yet.

 

MS13-0031 (KB2813170)

IMPORTANT

Elevation of Privilege in Windows Kernel

CVE-2013-1284CVE-2013-1294

You don't see race conditions very often in Windows these days but this month we have two of them. Both of them deal with how Windows handles objects in memory, which could allow an attacker to gain elevated privileges and read arbitrary amounts of kernel memory if successfully exploited. In both cases the attacker must be able to log on locally to a machine to take advantage of this flaw. Remember that locally in this case includes via Remote Desktop.

 

MS13-032 (KB2830914)

IMPORTANT

Denial of Service in Active Directory

CVE-2013-1282

If an attacker sends a specially crafted query to the Lightweight Directory Access Protocol (LDAP) service they could cause the service to stop responding resulting in a denial of service. An interesting aspect of this vulnerability is that it does not impact Itanium based servers.

 

MS13-033 (KB2820917)

IMPORTANT

Elevation of Privilege in Windows Client/Server Run-time Subsystem (CSRSS)

CVE-2013-1295

You are probably asking what the hell is the Client/Server Run-time subsystem? Well, it is the user-mode portion of the Win32 subsystem. Win32.sys is the other part and is the kernel-mode portion. CSRSS is responsible for handling console windows, creating and/or deleting threads, it's an essential subsystem that must be running at all times. Unfortunately if an attacker has logon credentials to a system and can run a specially crafted application that would then allow them to delete data or even create new accounts with full user rights.

 

MS13-034 (KB28223482)

IMPORTANT

Elevation of Privilege in Windows Defender

CVE-2013-0078

Windows Defender is Microsoft's Anti Malware client in Windows 8 and RT. The pathnames it uses could allow an elevation of privilege to an attacker who is able to successfully exploit this vulnerability. Don't get confused here; the Anti Malware Client is not updated with the Microsoft Malware Protection Engine and malware definitions updates so depending on the version of Windows Defender you have installed you may or may not see this offered to you via Microsoft update. If you don't see it offered then you should try to update manually, most users with up to date software should not have any issues here. You should definitely install this update as soon as you can, Microsoft thinks that this vulnerability will be pretty easy to exploit and expects exploit code to be written for this fairly soon.

 

MS13-035 (KB2821818)

IMPORTANT

Elevation of Privilege in HTML Sanitization Component

CVE-2013-1289

Who remembers MS12-066? Yeah, didn't think so. It was issued in October of last year and was very similar to the issue this month. The flaw is in the HTML sanitization routines that can impact InfoPath 2010 Groove Server, Office Web apps and most significantly SharePoint Foundation 2010. The bad strings could allow cross-site scripting attacks that could run scripts in the context of the logged-on user resulting in an Elevation of Privilege. Like last October's vulnerability this one was found in the wild on a limited basis making it doubly important to get those patches installed quickly.

 

MS13-036 (KB2829996)

IMPORTANT

Elevation of Privilege in Kernel Mode Drivers

CVE-2013-1283 CVE-2013-1291 CVE-2013-1292 CVE-2013-1293

This one requires that an attacker already have access to asystem, but once they do they can run a specially crafted application toincrease their privilege level. If you are looking in Microsoft Update and you seemultiple updates being offered that is normal, you will need to install themall. There are four different CVEs here, which may account for the multipleupdate packages. Two of them are a race condition, one is a font parsingvulnerability and one is a null pointer deference vulnerability. CVE-2013-1283, one of the race conditions, isalready being exploited to some extent in the wild and CVE-2013-1292, the otherrace condition, looks to be pretty easy to exploit so be sure to apply thispatch as soon as you can.

 

Latest SpiderLabs Blogs

Welcome to Adventures in Cybersecurity: The Defender Series

I’m happy to say I’m done chasing Microsoft certifications (AZ104/AZ500/SC100), and as a result, I’ve had the time to put some effort into a blog series that hopefully will entertain and inform you...

Read More

Trustwave SpiderLabs: Insights and Solutions to Defend Educational Institutions Against Cyber Threats

Security teams responsible for defending educational institutions at higher education and primary school levels often find themselves facing harsh lessons from threat actors who exploit the numerous...

Read More

Breakdown of Tycoon Phishing-as-a-Service System

Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, SpiderLabs’ Email Security team is tracking another PaaS called Tycoon Group.

Read More