Microsoft Fixes Eight Flaws, But Three Remain Open

Microsoft on Tuesday released five Security Bulletins addressing eight vulnerabilities, but left three zero-day vulnerabilities untended.

Paul Henry, forensic and security analyst for Lumension, said in an e-mail that the three zero-day vulnerabilities need to be addressed soon. Two are IIS vulnerabilities that were made public when exploit code was posted online about a week ago. The third is a vulnerability affecting Microsoft SMB2, for which exploit code was posted on Monday.

Microsoft said that the IIS vulnerabilities were not disclosed responsibly.

Laurent Graffie, who posted exploit code for the SMB2 vulnerability, claims that Microsoft was notified about the flaw but provides no information about the specific date the company was contacted.

Microsoft has not yet commented on the SMB2 issue.

Of the security issues that Microsoft did deal with, all five of its September Bulletins are designated "critical."

Three of them are what Microsoft characterizes as browse-and-get-owned attacks; two of them deal with network scenarios involving remote execution of malicious code or denial-of-service attacks.

MS09-045 fixes a vulnerability that allows remote code execution if a user opens a file or visits a Web site that calls a maliciously crafted Jscript.

MS09-047 patches two flaws in the Windows Media format that allow remote code execution upon opening a maliciously crafted file.

Both of these Bulletins are rated 1 on Microsoft's Exploitability Index, meaning that attackers are likely to start exploiting these vulnerabilities soon.

MS09-046 repairs a flaw in the DHTML Editing Component ActiveX Control. Producing exploit code for this flaw is believed to be somewhat complicated, giving it a less severe Exploitability Index rating of 2.

MS09-048 addresses three vulnerabilities in Windows TCP/IP.

And MS09-049 deals with one flaw in Windows' Wireless LAN AutoConfig Service.

Jason Miller, security and data team manager for Shavlik Technologies, says that the TCP/IP patch (MS09-048) should be applied first. "This bulletin resolves three vulnerabilities in the networking component TCP/IP," he said in an e-mailed statement. "In two of the vulnerabilities, attacks could cause a denial of service on target machines by sending specially crafted network packets that will cause the system to freeze or automatically restart."

Andrew Storms, director of security operations for nCircle, concurs. "Microsoft hasn't seen a serious bug in its TCP/IP stack in a long time, so it's pretty likely this is the exploit most people will focus on," he said in an e-mailed statement. "This update follows on the heels of yesterday's new zero-day 'blue screen of death' vulnerability and the combination of these two serious vulnerabilities will shake a lot of people's confidence in the integrity of Microsoft's networking stack."

Microsoft senior security program manager Jerry Bryant argues that MS09-045 and MS09-047 should be installed first, "mainly due to these being browse-and-own attack scenarios and a high Exploitability Index rating."

InformationWeek Analytics has published an independent analysis on strategic security. Download the report here (registration required).