Microsoft plans to deliver eight security bulletins on Patch Tuesday next week. Three of them are rated critical; five are important. The three critical updates address vulnerabilities in Internet Explorer and Microsoft Windows. The important updates address issues in Windows and Office.
What this release won’t include is an update for the zero-day vulnerability that impacts Office, Windows and Lync announced earlier this week. Dustin Childs, group manager for the Microsoft Security Response Center, said the company is working to develop a security update and will release it when it’s ready. That opens the door to the possibility of an out-of-band patch for the flaw, which exists in the way affected components handle TIFF images.
“In the meantime, the advisory includes a Fix it that prevents the attacks from succeeding and we recommend customers apply it to help protect their systems,” Childs said. “We also want to provide clarification on the products that the advisory notes are affected. We’ve seen some confusion due to the shared nature of the GDI+ component, which is where the issue resides. There are three ways you can have the GDI+ component installed on your system: Office, Windows, and Lync.”
Relief and Frustration
With regard to the TIFF flaw, Childs said Office 2003 and Office 2007 are affected regardless of the installed operating system. Microsoft is currently only aware of targeted attacks against Office 2007 users. Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems. Office 2013 is not affected, regardless of the OS platform.
On the Windows side, supported versions of Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack. Other versions of Windows are not directly impacted. Customers who use these systems are only impacted if they have an affected version of Office or Lync, Childs said. All supported versions of the Lync client are affected but are not known to be under active attack.
“The November Patch Tuesday Advance Bulletin is out and I think everyone is breathing a sigh of both relief and frustration,” Ross Barrett, senior manager of security engineering at security firm Rapid7, told us. “Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday, with fixes for most Windows versions, the ever-present IE roll-up patch, and some Office components, but nothing esoteric or difficult to patch. No SharePoint plugins, no complicated .NET patching, no esoteric office extensions.” And frustration, he added, because there’s no fix for the zero-day flaw.
Another Busy Month
Overall, Paul Henry, a security and forensic analyst at security firm Lumension, told us it’s another busy month for IT. As he sees it, the first patching priority should be bulletin 1, which is a critical remote code execution for Internet Explorer given its widespread use.
The second priority would be bulletin 2, which could allow a remote code execution in Windows. Third on your list of priorities will likely be the final critical bulletin, number 3, he said, which will be another remote code execution in Windows.
“The remaining bulletins shake out with an important rating,” he said. “Bulletin 4 will be a remote code execution for Office. Bulletin 5 will be an elevation of privilege issue in Windows. Bulletin 6 an information disclosure issue in Windows, bulletin 7 an information disclosure issue in Office, and bulletin 8 will be a denial of service in Windows.”