Thursday 12 November 2009

Patch Tuesday: November 2009

The November Patch Tuesday update from Microsoft follows the largest patch and security update in Microsoft’s history. This month there are six updates to Office, Active Directory and Microsoft’s Office application suite.
These six updates have a low impact, bar one patch to Excel which may cause compatibility issues for some applications. The main cause for concern here is that Excel is a primary if not essential element to many environments. For example most banking, trading floor and insurance platforms. Therefore any change must be tested rigorously.
Whilst there are few applications in our sample that are affected, the ChangeBASE AOK team recommends that the Excel update (MS09-067) requires particular attention in any environments where there is a significant dependency on this,

We have included a brief snap-shot of some of the results from our AOK Software that demonstrates some of the potential impacts on Microsoft Office deployments with the following picture.



Testing Summary
  • MS09-063 : : Marginal impact and negligible testing profile
  • MS09-064 : : Marginal impact and negligible testing profile
  • MS09-065 : : Marginal impact and negligible testing profile
  • MS09-066 : : Marginal impact and negligible testing profile
  • MS09-067 : : Moderate impact and negligible testing profile
  • MS09-068 : : Marginal impact and negligible testing profile


Patch NameTotal
Issues
Matches
Affected
RebootRatingRAG
Microsoft Security Bulletin MS09-063<1%<1%YESCriticalGreen
Microsoft Security Bulletin MS09-064<1%<1%YESCriticalGreen
Microsoft Security Bulletin MS09-065<1%<1%YESCriticalGreen
Microsoft Security Bulletin MS09-066<1%<1%YESImportantGreen
Microsoft Security Bulletin MS09-0671%1%YESImportantAmber
Microsoft Security Bulletin MS09-068<1%<1%YESImportantGreen

Legend:
No IssueNo Issues Detected
FixablePotentially fixable application Impact
SeriousSerious Compatibility Issue

Security Update Detailed Summary
MS09-063Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565)
DescriptionThis security update resolves a privately reported vulnerability in the Web Services on Devices Application Programming Interface (WSDAPI) on the Windows operating system. The vulnerability could allow remote code execution if an affected Windows system receives a specially crafted packet. Only attackers on the local subnet would be able to exploit this vulnerability.
PayloadWsdapi.dll
ImpactCritical – Remote Code Execution

MS09-064Vulnerability in License Logging Server Could Allow Remote Code Execution (974783)
DescriptionThis security update resolves a privately reported vulnerability in Microsoft Windows 2000. The vulnerability could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter.
PayloadLlscustom.dll
ImpactCritical – Remote Code Execution

MS09-065Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947)
DescriptionThis security update resolves several privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font. In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted embedded fonts that are used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince the user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the attacker's site.
PayloadWin32k.sys, W32ksign.dll
ImpactCritical – Remote Code Execution

MS09-066Vulnerability in Active Directory Could Allow Denial of Service (973309)
DescriptionThis security update resolves a privately reported vulnerability in Active Directory service, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The vulnerability could allow denial of service if stack space was exhausted during execution of certain types of LDAP or LDAPS requests. This vulnerability only affects domain controllers and systems configured to run ADAM or AD LDS.
PayloadAdamdsa.dll
ImpactImportant – Remote Code Execution

MS09-067Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652)
DescriptionThis security update resolves several privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
PayloadExcel.exe
ImpactImportant – Remote Code Execution

MS09-068Vulnerability in Microsoft Office Word Could Allow Remote Code Execution (976307)
DescriptionThis security update resolves a privately reported vulnerability that could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
PayloadWinword.exe
ImpactImportant – Remote Code Execution

No comments: