Patch Tuesday -April 14th

As I do now every month, I post up the Patch Impact Report for Microsoft's Patch Tuesday.

This month includes 8 patches, two rated Important, one moderate and the others are rated as Critical. These patches affect all operating systems from Windows 2000, XP through to VISTA and Windows 7 beta and system administrators should be aware that they will require all servers and desktops running these operating systems to be rebooted. Six of the eight patches explicitly state that a reboot is required, however the nature of the changes being made by the other two patches make it highly likely that these will also require a reboot although this is not explicitly stated in the documentation.

After loading the ChangeBase AOK application testing portfolio into a Patch Impact database, all eight patches were tested for application level issues and in addition, application dependencies. Only one update (MS09-014) raised a significant number of issues across a small number of applications across the ChangeBase Patch Testing Application portfolio.

Here is a sample report extract from one of the few applications in the AOK ChangeBase Application Test Portfolio that raised a dependency level issue with the MS09-014 Update.


Testing Summary

• MS09-009: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-010: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-011: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-012: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-013: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-014: Moderate Impact (both Package level and dependencies) detected across portfolio
• MS09-015: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-016: Marginal Impact (both Package level and dependencies) detected across portfolio

Patch Name	Total Issues	Matches Affected	Reboot	Rating	RAG
Microsoft Security Bulletin MS09-009	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-010	8	<1%	YES	Critical
Microsoft Security Bulletin MS09-011	<1%	<1%		Critical
Microsoft Security Bulletin MS09-012	<1%	<1%	YES	Critical
Microsoft Security Bulletin MS09-013	<1%	<1%		Critical
Microsoft Security Bulletin MS09-014	96	6%	YES	Important
Microsoft Security Bulletin MS09-015	<1%	<1%	YES	Important
Microsoft Security Bulletin MS09-016	<1%	<1%	YES	Moderate

Legend:

No Issues Detected Potentially fixable application Impact Serious Compatibility Issue

Security Update Detailed Summary

MS09-009	Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)
Description	This security update resolves a privately reported and a publicly disclosed vulnerability. The vulnerabilities could allow remote code execution if the user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Excel.exe
Impact	Remote Code Execution

MS09-010	Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)
Description	This security update resolves two publicly disclosed vulnerabilities and two privately reported vulnerabilities in Microsoft WordPad and Microsoft Office text converters. The vulnerabilities could allow remote code execution if a specially crafted file is opened in WordPad or Microsoft Office Word. Do not open Microsoft Office, RTF, Write, or WordPerfect files from untrusted sources using affected versions of WordPad or Microsoft Office Word.
Payload	Html32.cnv, Msconv97.dll, Mswrd632.cnv, Mswrd832.cnv, Wpft532.cnv, Wpft632.cnv
Impact	Spoofing

MS09-011	Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373)
Description	This security update resolves a privately reported vulnerability in Microsoft DirectX. The vulnerability could allow remote code execution if user opened a specially crafted MJPEG file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Quartz.dll
Impact	Remote Code Execution

MS09-012	Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
Description	This security update resolves four publicly disclosed vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker is allowed to log on to the system and then run a specially crafted application. The attacker must be able to run code on the local machine in order to exploit this vulnerability. An attacker who successfully exploited any of these vulnerabilities could take complete control over the affected system.
Payload	Dtcsetup.exe, Msdtclog.dll, Msdtcprx.dll, Msdtctm.dll, Msdtcui.dll, Mtxclu.dll, Mtxoci.dll, Sp3res.dll, Xolehlp.dll
Impact	Elevation of Privilege

MS09-013	Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
Description	This security update resolves one publicly disclosed vulnerability and two privately reported vulnerabilities in Microsoft Windows HTTP Services (WinHTTP). The most severe vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Winhttp.dll
Impact	Remote Code Execution

MS09-014	Cumulative Security Update for Internet Explorer (963027)
Description	This security update resolves four privately reported vulnerabilities and two publicly disclosed vulnerabilities in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer or if a user connects to an attacker's server by way of the HTTP protocol. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Payload	Browseui.dll, Danim.dll, Dxtmsft.dll, Iecustom.dll, Iepeers.dll, Inseng.dll, Jsproxy.dll, Mshtml.dll, Msrating.dll, Pngfilt.dll, Shdocvw.dll, Shlwapi.dll, Url.dll, Urlmon.dll, Wininet.dll, Iecustom.dll
Impact	Remote Code Execution

MS09-015	Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426)
Description	This security update resolves a publicly disclosed vulnerability in the Windows SearchPath function that could allow elevation of privilege if a user downloaded a specially crafted file to a specific location, then opened an application that could load the file under certain circumstances.
Payload	Secur32.dll
Impact	Elevation of Privilege

MS09-016	Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (961759)
Description	This security update resolves a privately reported vulnerability and a publicly disclosed vulnerability in Microsoft Internet Security and Acceleration (ISA) Server and Microsoft Forefront Threat Management Gateway (TMG), Medium Business Edition (MBE). These vulnerabilities could allow denial of service if an attacker sends specially crafted network packages to the affected system, or information disclosure if a user clicks on a malicious URL or visits a Web site that contains content controlled by the attacker.
Payload	Cookieauthfilter.dll, msphlpr.dll, wspsrv.exe, Fweng.sys, Fweng64.sys, Fweng64100.sys, Msfpcpatch.dll,
Impact	Elevation of Privilege

Windows 7 - Touching up your legacy apps

It has been quite a while since my last blog posting. I have been travelling pretty extensively over the past few weeks, and one of the challenges (apart from running from flight to flight) of working abroad and on a client site, is that there is generally little time for "background" tasks like blogging.

That said, I am having a great time with working our clients and it looks like we have found a few more legacy application compatibility issues with Windows 7.

Windows 7 now includes "Touch" support - which on top of "Sensor " support (movement, location, temperature) I think will be the "killer apps" for Windows 7. I have been told by the senior powers that be at Microsoft, that Windows 7 does not have killer apps. "We have pillars, that people; developers in our ecosystem, build upon to create killer apps", I am told. "Fine", I replied, "Then Touch and Sensor support are killer pillars". I quite like the sound of that; Killer Pillars.

Back to the application compatibility issues.

Touch under Windows 7 crashes legacy VB applications that use the old (versions 5 and 6) of the COMCTL control (Mscomctl.ocx or Comctl32.ocx). If your application has a dependency on these controls - it will crash with a wonderful "divide by zero error".

The two problem scenarios outlined by Microsoft include;

• You are running an application that sets a WinEvent hook on Microsoft Windows 2000 or a later operating system version.
• You start an application that uses the ListView control or the TreeView control from Microsoft Windows Common Controls 5.0.


For more information, please refer to the Microsoft support link; http://support.microsoft.com/kb/896559

The fix for this issue is clear; you must scan all of your application packages, and get rid of those legacy versions of these controls. This "cleaning" process must include removing all other configuration settings (registry and COM information) from the offending package. In addition, you will need to validate your application for dependencies on these List and Drop-down controls.

Patch Tuesday: March 2009

This month includes 3 patches, one rated Critical and the other rated as Important. These patches affect all operating systems from Windows 2000, XP through to VISTA and Windows 7 beta and will require all servers and desktops running these operating systems to be rebooted. The good news is that from an application compatibility perspective this is a minor update from Microsoft.

This will bring relief to IT departments after the February release.

Looking further at the March update, after loading the ChangeBASE AOK application testing portfolio into a Patch Impact database, all three patches were tested for application level issues and in addition, application dependencies. None of three patches (MS09-006, MS09-007, and MS09-008) raised significant numbers of application level or dependency level issues with the AOK Application Test portfolio.

Given the very low numbers of issues, the ChangeBASE AOK team recommends that these patches are rapidly deployed to a staging environment and then subsequently into Production. The ChangeBASE AOK team recommends that with all changes to an environment basic UAT testing is performed on all business critical applications. However, for these three March Microsoft Security updates, only marginal build level testing should be required.

Here is a sample report extract from one of the few applications in the AOK ChangeBASE Application Test Portfolio that raised a dependency level issue with the MS09-006 Security Update.


Testing Summary

• MS09-006: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-007: Marginal Impact (both Package level and dependencies) detected across portfolio
• MS09-008: Marginal Impact (both Package level and dependencies) detected across portfolio

Patch Name	Total Issues	Matches Affected	Reboot	Rating	RAG
Microsoft Security Bulletin MS09-006	27	<1%	YES	Critical
Microsoft Security Bulletin MS09-007	7	<1%	YES	Important
Microsoft Security Bulletin MS09-008	22	<1%	YES	Important

Legend:

No Issues Detected Potentially fixable application Impact Serious Compatibility Issue

c. 800 applications were tested against these patches using the ChangeBASE ACL (Application Compatibility Lab)

Security Update Detailed Summary

MS09-006	Vulnerabilities in Windows Kernel Could Allow Remote Code Execution (958690)
Description	This security update resolves several privately reported vulnerabilities in the Windows kernel. The most serious vulnerability could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system.
Payload	Win32k.sys
Impact	Remote Code Execution

MS09-007	Vulnerability in SChannel Could Allow Spoofing (960225)
Description	This security update resolves a privately reported vulnerability in the Secure Channel (SChannel) security package in Windows. The vulnerability could allow spoofing if an attacker gains access to the certificate used by the end user for authentication. Customers are only affected when the public key component of the certificate used for authentication has been obtained by the attacker through other means.
Payload	Schannel.dll
Impact	Spoofing

MS09-008	Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238)
Description	This security update resolves two privately reported vulnerabilities and two publicly disclosed vulnerabilities in Windows DNS server and Windows WINS server. These vulnerabilities could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker's own systems.
Payload	Afd.sys, Dns.exe, Dnsperf.dll, Dnsperf.h, Dnsperf.ini, Msafd.dll, Sp3res.dll, Tcpip.sys
Impact	Spoofing

The Windows 7 Engineering guys are doing a superb job right now. My own experiences coupled with the feedback I am getting, is that with respect to Application Compatibility Windows 7 compatibility is "better" than Vista. 

I was trying to explain the situation to a colleage about the "Windows 7 Compatibility" story and I used the analogy, "that application compatibility with Windows 7 today is like what Windows Vista experiened 18 months after it's release". There are going to be a few "gotcha's" out there (who is using Microsoft Agent anymore?) but generally the Microsoft partner and ISV eco-system is gearing up for the release of Windows 7 rather than "waiting and see" what the final release candidate will look like. This can only be a good thing.

However, I was a  little concerned by a recent posting by the Engineering Windows 7 team blog (found here: http://blogs.msdn.com/e7)

There is a posting on Application Compatibility testing that raised a few eyebrows within our group. The posting in question is located here: http://blogs.msdn.com/e7/archive/2009/03/09/application-compatibility-testing-international.aspx

And, the content in question is the list of applications that was tested for application compatibility. Here is a brief (non-exhaustive) list reproduced from the site; 

• orwegian1Visma Avendo FaktureringPolish2
  
• WF-Fakturka dla Windows
  
• Nahlik eTeacher 5
  
• Portugese1Mr. Escola Win PortSpanish3
  
• Mexico Federal Taxes Simplified SAT: Individual Taxes
  
• Monografias Spanglish
  
• IKEA Home Kitchen Planner
  
• Turkish1MYTR Filter 2.6
  

Now, to be fair the blog entry was intending to demonstrate some of the international applications that were included in the application compatiblity testing program for Windows 7.  This is all good stuff.

However, when you look at the titles, you see a distinct consumer bent to the applications. This could be just the small sample size of the blog posting (maybe Microsot tests 1000's of applications) but it does look like these are some of these applications are the easier titles to obtain (either cheap, easily downloadable or trial versions). 

What's missing? Some hard-core applications that are present on just about every desktop? Examples include; AutoCAD for the Engineering sector, Bloomberg and Reuters for Banking, SAP for the the Finance groups.  

From this admittedly small sample size, I have a few questions;

• Just how big is Microsoft's application compatibility software purchasing plan?
  
• Does it cover enterprise applications
  
• How may applications are included in this list?
  
• Is there an ecosystem or Partner program that ISV's can join to include their applications in this testing effort?
  

Just as a bit of a boot note, I wanted to find out a bit more about these applications and so I googled them and got the following result for WF-Fakturka dla Windows;

Is this the reason why this application was chosen? Easy to crack, easy to "app-compat". I am sure this is not the case.... 

The IE8 Compatibility Journey

I wanted to take a few minutes today to outline some of the Internet Explorer 8 compatibility issues that have been documented by Microsoft. This is a little bit of a cut and paste of some of the documentation, but I have distilled some of the issues that I feel that may cause some application level issues. Here is my list, with a warning that this is just the beginnging of my investigation;

Cross-Site Scripting Filter

XSS attacks have emerged as a leading exploit against Web servers and Web applications. Internet Explorer 8 has an XSS filter that is able to dynamically detect type-1 XSS (reflection) attacks. This helps protect users and systems from attacks that can lead to information disclosure, cookie stealing, account/identity theft or other attempts to masquerade as the user without permission. 

 

DEP/NX Security Restrictions

DEP/NX helps to foil attacks by preventing code from running in memory that is marked non-executable.  DEP/NX, combined with other technologies like Address Space Layout Randomization (ASLR), make it harder for attackers to exploit certain types of memory-related vulnerabilities like buffer overruns. In turn, this may cause some applications to crash unexpectedly.

 

File Name Restriction

Internet Explorer 8 form submission has been changed so that a file upload control (input type=file) only submits the file path to the server. Previously, the full path was sent to the server. This change may cause application compatibility issues with applications that assume a specific location for a particular file.

 

Codepage Sniffing

Internet Explorer 8 prevents certain codepages from participating in its Codepage Sniffing heuristic. Any pages that rely on this heuristic to be recognized as 7-bit Unicode Transformation Format (UTF-7) will no longer be detected.

 

AJAX Navigation

Internet Explorer 8 (IE8) includes an Asynchronous JavaScript and XML (AJAX) navigation feature that allows sites to maintain and track changes in AJAX states by treating them as a navigation.  This can be problematic for sites that were using the "location.hash" feature  to send data between cross-domain components.

 

Application Protocol Detection

The Application Protocol Handler Dialog security feature protects users from accidentally executing an application with dangerous content. This feature may inadvertently cause some applications to hang or not respond as expected.

 

MIME Type Detection Restrictions

Internet Explorer 8 (IE8) uses web-based MIME information to determine how to handle files sent by a Web server. The MIME Handling Restrictions feature reports an unsafe content handler when the reported MIME file type does not match the observed MIME file type, and the content handler for the observed MIME file type is unsafe.

 

Web Proxy Error Handling Changes

Internet Explorer 8 blocks application content returned by a proxy from a failed CONNECT command, or displays the content in a context based on the hostname of the proxy rather than in the context of the origin server. This may cause an application to hang or not behave as expected.

 

Signed Certificate Filtering

Microsoft's Internet Explorer 8 (IE8) uses Certificate Filtering to select the appropriate certificate for client authentication. This feature has been improved  from the version in IE7 to remove certificates that are likely to be rejected by the server. This may cause some intranet or in-house developed applications to fail. 

Let me know what you think about these issues. I think that there are going to be a few more. And so, I will keep you posted.