Microsoft exceedes 100 bulletins for 2013
It’s been an interesting month for the Microsoft Security watchers of the world. If your job depends on securing systems running Windows, you should be eagerly awaiting the patch for the Internet Explorer (IE) 0-day (CVE-2013-3893: SetMouseCapture Use-After-Free) vulnerability in today’s Patch Tuesday (MS13-080). Exploitation of this vulnerability was detected first in targeted, regionally restricted exploitation, and then later in broader use once the exploit code spread to various public sites. Hopefully users have applied the Microsoft FixIt and/or EMET mitigations, and maybe even tested them with the Metasploit module that came out last week.
What you probably don’t know, unless you work in Security Response at Microsoft or have connections into what one might call an “Advanced Persistent Threat,” is that out of the nine other IE vulnerabilities patched by MSFT this month, there is a second IE 0-day that has also been detected at use in targeted exploitation. This is CVE-2013-3897.
Now, that’s not to say that the remaining eight IE vulnerabilities are not potentially just as bad or worse. However, at least at this time, they are not known to be in use by the “bad guys.”
MS13-081 addresses an exploit path (CVE-2013-3128) which would give an attacker kernel-level access on a system that attempts to render a page containing a malicious opentype font. Technically one of the CVEs in MS13-082 addresses a variant of the same issue, which Microsoft found by auditing the reuse of that code. In this case the variant would only give user-level access to that attacker. At this time this issue is not known to be under active exploitation. This advisory also includes six other vulnerabilities of varying severity.
MS13-083 looks like a really fun one – a remote, server-side vulnerability offering remote code execution that is hittable through ASP.net web pages. This is a genuine article; a real, honest to goodness, potentially “wormable” condition. If the “bad guys” figure out a way to automate the exploitation of this, it could spread rapidly and the defense in depth measures of your organization will be tested. However, this vulnerability was privately reported to Microsoft and is not known to be under active exploitation.
On top of all that, there are four MS Office vulnerabilities. These issues have only been tagged as “important” for one reason or another. Don’t ignore them, but patch the other issues in this month’s advisory first if you have to make that kind of decision.
Author: Ross Barrett, Senior Manager, Security Engineering, Rapid7.