I feel some compassion for those system administrators alongthe East Coast of the US this week. Big storms like Hurricanes, Tornadoes andNor' Easters are nothing to laugh at. Dealingwith high water and no power can stress out any system administrator whether inNew York or in Kansas. At least it was just a hurricane and not a magicaltornado that carried you off to a mystical land with flying monkeys, talkingscarecrows, and houses falling out of the sky onto the local population. Iwould hate to have to patch systems in the Emerald City with the lure of fieldsof poppies just outside my window.
This Patch Tuesday isn't anything to sneeze at either. Thereisn't that many bulletins in comparison to previous months, only six, but theycover a fair number of vulnerabilities, nineteen in all, and a majority of themare pretty serious resulting in remote code execution for five of the sixbulletins. One of them even coversWindows RT, that's right, that shiny new MS Surface already needs a patch.
MS12-071 (KB 2761451)
CRITICAL
Remote Code Executionin Internet Explorer
CVE-2012-1538 CVE-2012-1539 CVE-2012-4775
Like the three munchkins of the Lollipop Guild the threeCVE's fixed in this bulletin would like to welcome you to Patch Tuesday. Thethree vulnerabilities involve 'Use After Free' vulnerabilities in InternetExplorer 9. It looks like earlier versions and IE 10 are not affected. Thesecan all be exploited with a specially crafted web page, which would give anattacker the same rights to a system as the currently logged in user. While there does not seem to be any indicationthat these vulnerabilities are being actively exploited Microsoft does expectexploit code to be available in the wild soon.
MS12-072 (KB 2727528)
CRITICAL
Remote Code Executionin Windows Shell
CVE-2012-1572 CVE-2012-1528
These two vulnerabilities involve a buffer overflow and an underflowof a Windows Briefcase. A Briefcase allows mobile PC users to easily transferfiles to a removable drive and then have it synchronize those documents betweenthe PC and the drive. Thesevulnerabilities can be exploited if a user browses to a specially craftedBriefcase using Windows Explorer, which could give an attacker the ability toexecute arbitrary code. Microsoft hasn'tseen this in use yet by the Wicked Witch of the West but her flying monkeyswill probably figure it out pretty quickly.
MS12-073 (KB 2733829)
MODERATE
Information Disclosurein IIS
CVE-2012-2531 CVE-2012-2532
This is the only moderate bulletin this month and the onlyone that doesn't result in Remote Code Execution. Just because there is no RCE does not beenyou should leave the Yellow Brick Road and not install the patch, be protectedand continue on the path. This patch fixes two CVEs the most severe of whichcan be exploited with specially crafted FTP commands.
MS12-074 (KB 2745030)
CRITICAL
Remote Code Executionin .NET Framework
CVE-2012-1895 CVE-2012-1896 CVE-2012-2519 CVE-2012-4776CVE-2012-4777
Like Dorthy's ruby red slippers whisked her away from themagical land of OZ this patch will whisk you away from the evils of five CVEs. If a band evil flying monkeys convinces you touse a malicious proxy auto configuration file, most likely via aman-in-the-middle attack, they can then inject code into the currently runningapplication giving them the ability to execute remote code. If the evil flying monkeys are already insideyour network they could even do some ARP cache poisoning or NBNS spoofing andredirect local requests for the WPAD file. The vulnerabilities are found inmost versions of .NET, which can be found in XP SP3 up to Server 2008.
MS12-075 (KB 2761226)
CRITICAL
Remote Code Executionin Windows Kernel Mode Drivers
CVE-2012-2530 CVE-2012-2553 CVE-2012-2897
If you got a shiny new Microsoft Surface tablet that runsWindows RT and thought you didn't need courage to surf the Internet anymorelike the Cowardly Lion you better find some courage soon and install thispatch. A specially crafted document or web page that uses True Type Files canexploit this vulnerability that affects most versions of Windows including RT.Windows RT is of course the OS that powers the Microsoft Surface. The updatefor RT is only available through Windows Update and is not offered as aseparate download.
MS12-076 (KB 2720184)
IMPORTANT
Remote Code Executionin Microsoft Excel
CVE-2012-1885 CVE-2012-1886 CVE-2012-1887 CVE-2012-2543
A specially crafted Excel file could allow an attacker togain the same privileges as the currently logged in user and therefore runarbitrary code. The problem exists in Excel 2003, 2007, 2010 and 2008 and 2011for Mac. You can throw water on it and melt this witch of a vulnerability byapplying the patch.
Don't let the Wicked Witch of the West get you and yourlittle dog Toto, find the Wizard in the Emerald city and apply those patches!