Pull up your bootstraps Microsoft administrators, because you’re in for a long patch slog this month. According to their March Patch Day summary, Microsoft released 14 security bulletins, many fixing critical issues. I highlight the details below, so get ready to get patching.
By the Numbers:
- all current versions of Windows,
- Internet Explorer (IE),
- Exchange server,
- and VBScript.
They rate five bulletins as Critical and the rest as Important.
Patch Day Highlights:
There are many vulnerabilities worth fixing this month, but two major highlights.
- Remember FREAK? It’s that SSL implementation vulnerability that I’ve been talking about in blog posts and multiple videos. Well, it affects Windows too and they fixed it this month. If you’ve been concerned about black hats sniffing your SSL, be sure to get the FREAK update (MS15-031).
- Also, remember Stuxnet? I’m sure you do, since it was one of the most sophisticated attacks the industry has ever seen. When it was discovered, it used four different zero day vulnerabilities to help itself spread, including a .LNK file vulnerability that helped it infect others via USB storage devices. Microsoft tried to patch this flaw years ago, but apparently failed. The MS15-020 update completes the botched job, so be sure to get that update. If you want to learn more about the update’s relation to Stuxnet, check out this HP blog post.
While these those two updates are probably the most interesting, this month’s bulletins include many more critical patches. For instance, March’s Internet Explorer (IE) update fixes 12 security flaws that bad guys can leverage in drive-by download attacks. Also, Exchange administrators will probably want to apply its update quickly, even though Microsoft only reports it as Important. If attackers can get your email users to click a link, they can exploit various Exchange flaws to gain access to your users’ OWA accounts. In short, we recommend you apply Microsofts updates quickly, in the order we share them below.
Quick Bulletin Summary:
We summarize the March security bulletins below in order of severity. We recommend you apply the updates in the same order of priority, assuming you use the affected products.
- MS15-018 – Critical – IE Memory Corruptions Flaws – The Internet Explorer (IE) update mostly fixes a bunch of memory corruption flaws remote attackers could leverage to execute code. These are the types of flaws typically used in drive-by download attacks. If an attacker can get you to visit a site with malicious code, he could exploit these flaws to run code on your machine. If you have local administrator privileges, the attacker gains full control of your PC. Web-based drive-by downloads are pretty popular with attackers right now, so we recommend you apply this update quickly.
- MS15-019 – Critical- VBScript RCE Flaw – VBScript is a Microsoft specific scripting language that ships with Windows and IE. It suffers from a memory corruption flaw that attackers could leverage to execute code with your privileges. This is actually one of the vulnerabilities corrected by the IE update mentioned above, but Microsoft has to fix it in VBScript as well since it ships independently. Similar to the IE flaws, attackers would likely leverage this vulnerability in drive-by download attacks.
- MS15-020 – Critical – Two Windows Code Execution Flaws – Remember Stuxnet? This update fixes one of its zero day vulnerabilities… again! Windows suffers from two code execution flaws involving its Windows Text Services (WTS) and the way it loads DLLs. The WTS flaw poses the most obvious risk. If an attacker can trick one of your users into visiting a malicious web site, or opening a specially crafted file, she can exploit the WTS issue to execute code on that user’s computer, with the user’s privileges. If the user was a local admin, the attacker gains full control of your user’s PC. However, the “DLL Planting” vulnerability is pretty bad too, since it’s actually one that the infamous Stuxnet malware exploited years ago. While Microsoft’s alert doesn’t describe it this way, the DLL loading fix is related to the shortcut .LNK vulnerability that was supposedly fixed in 2010. You can read more about it on this blog.
- MS15-021 – Critical – Multiple Adobe Font Driver Vulnerabilities – Windows ships with an Adobe font driver to handle—as its name suggests—Adobe fonts. This driver suffers from many flaws, including a denial of service (DoS) issue, an information leak flaw, and a number of memory corruption vulnerabilities. Attackers could exploit the memory corruption flaws to execute code on your computer, assuming they can trick you into visiting a booby-trapped web site, or opening a file with maliciously crafted fonts.
- MS15-022 – Critical – Multiple Office Component Vulnerabilities – Office, and the components that ship with it (such as Word, Excel, and Sharepoint server), suffer from a range of five vulnerabilities. The worst are three code execution flaws that black hats can exploit by luring you into opening malicious office documents. However, Sharepoint also suffers from a few cross-site scripting (XSS) vulnerabilities as well.
- MS15-026 – Important – Five Exchange Server Vulnerabilities – Exchange, Microsoft’s popular email server, suffers from five vulnerabilities. The four worst flaws are all cross-site scripting (XSS) vulnerabilities in various parts of Outlook Web Access (OWA). While they differ technically, they all have the same affect. If an attacker can lure you into clicking a specially crafted link, or into visiting a web site containing a malicious link, he can exploit any of these four flaws to gain control of your OWA account, and do anything you could (for instance, send and read your email). Since OWA is pretty popular among Exchange administrators, and often exposed publicly, I consider this update a fairly high priority.
- MS15-023 – Important – Four Kernel-Mode Driver Flaws– The Windows Kernel-Mode Driver suffers from four security vulnerabilities; the most serious being a local elevation of privilege (EoP) flaw. If an attacker can log into your system, and run a specially crafted program, he can leverage this particular EoP flaw to gain complete control of that Windows computer. The remaining three issues are memory disclosure vulnerabilities attackers could use to gain more information about your system than you would like.
- MS15-024 – Important – PNG Information Disclosure Flaw – Windows doesn’t handle PNG images correctly. If an attacker can get you to open a malicious PNG image, he can leverage this flaw to learn more about your system, which could aid him in further attacks.
- MS15-025 – Important – Windows Kernel EoP Flaws – The Windows kernel suffers from two vulnerabilities that local attackers can exploit to elevate their privileges. Though the flaws differ technically, they share the same impact. By running a specially crafted program, a local attacker (with valid credentials) can gain full control of a Windows system. However, they can’t exploit these flaws unless they can already log onto your systems.
- MS15-027 – Important – NETLOGON Spoofing Vulnerability – The Windows NETLOGON component suffers from a flaw that allows local attackers to spoof another legitimate user on your Windows network. However, to exploit this flaw an attacker must already be able to log in to your network using valid domain credentials, which significantly lessens its impact.
- MS15-028 – Important – Task Scheduler Security Bypass Flaw – The Windows Task Scheduler—a component that allows users to run programs at specified times—suffers from a flaw involving its inability to properly enforce user privileges. In short, an unprivileged user can leverage this issue to run programs they’re not supposed to have access to. That said, they need credentials on your system to exploit this flaw.
- MS15-029 – Important – JPEG XR Information Disclosure Flaw – The component used to display certain JPG images suffers from memory handling flaw that unintentionally leaks information about your system. If you view a malicious image, the attacker may (or may not) gain access to some information that could aid him further in an attack.
- MS15-030 – Important – RDP DoS Vulnerability– The Windows Remote Desktop Protocol (RDP) suffers from a denial of service (DoS) vulnerability. In short, by sending specially crafted packets and unauthenticated attacker can take out your RDP server, and prevent legitimate users from connecting. If you allow access to RDP, you’ll want to fix this flaw.
- MS15-031 – Important – Schannel FREAK Vulnerability– You know that SSL FREAK vulnerability we’ve written about and done multiple videos about over the past week? This Schannel update fixes it for Windows. If you concerned with SSL man-in-the-middle (MitM) attackers, you should apply this patch.
If you use any of the software mentioned above, you should apply the corresponding updates as soon as you can. I recommend you apply the Critical updates immediately, try to get to the Important ones as a soon as possible, and leave the moderate ones for last.
You can get the updates three ways:
- Let Windows Automatic Update do it for you – While patches sometimes introduce new problems, these occasional issues don’t seem to affect clients as often as they do servers. To keep your network secure, I recommend you set Windows clients to update automatically so they get patches as soon as possible.
- Manually download and install patches – That said, most businesses strongly rely on production servers and server software. For that reason, I recommend you always test new server updates before applying them manually to production servers. Virtualization can help you build a test environment that mimics your production one for testing. You can find links to download the various updates in the individual bulletins I’ve linked above.
- Download February’s full Security Update ISO – Finally, Microsoft eventually posts an ISO image that consolidates all the security updates. This ISO conveniently packages the updates in one place for administrators. You’ll eventually find a link to the monthly security ISOs here, but Microsoft may not post it until a few days after Patch Day
For WatchGuard Customers:
Good News! WatchGuard’s Gateway Antivirus (GAV), Intrusion Prevention (IPS), and APT Blocker services can often prevent these sorts of attacks, or the malware they try to distribute. For instance, our IPS signature team has developed signatures that can detect and block many of the attacks described in Microsoft’s alerts:
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1634)
- WEB Cross-site Scripting -11
- WEB Cross-Site Scripting -7
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1626)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1625)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1624)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1623)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1622)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-0100)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-0099)
- FILE Vulnerabilities in Adobe Font Driver Could Allow Remote Code Execution
- SMB NETLOGON Spoofing Vulnerability (CVE-2015-0005)
- WEB-CLIENT Microsoft Internet Explorer VBScript Memory Corruption Vulnerability (CVE-2015-0032)
- WEB-CLIENT Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-0056)
- WEB-CLIENT Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2015-0072)
- WEB-CLIENT Microsoft Internet Explorer JPEG XR Parser Information Disclosure Vulnerability (CVE-2015-0076)
- WEB-CLIENT Microsoft Internet Explorer Malformed PNG Parsing Information Disclosure Vulnerability (CVE-2015-0080)
- WEB-CLIENT Microsoft Internet Explorer WTS Remote Code Execution Vulnerability (CVE-2015-0081)
- FILE Microsoft Office Component Use After Free Vulnerability (CVE-2015-0085)
- FILE Microsoft Office Memory Corruption Vulnerability (CVE-2015-0086)
- FILE Microsoft Word Local Zone Remote Code Execution Vulnerability (CVE-2015-0097)
- FILE Microsoft DLL Planting Remote Code Exectution Vulnerability (CVE-2015-0096)
Your Firebox or XTM appliance should get this new IPS signature update shortly.
Furthermore, our Reputation Enabled Defense (RED) and WebBlocker services can often prevent your users from accidentally visiting malicious (or legitimate but booby-trapped) web sites that contain these sorts of attacks. Nevertheless, we still recommend you install Microsoft’s updates to completely protect yourself from all of these flaws. — Corey Nachreiner, CISSP (@SecAdept)