It's Black Tuesday for Microsoft, with 26 Flaws Patched

Published: August 20, 2008

by Alex Woodie

In what some have taken to calling Black Tuesday, Microsoft last week issued 11 patches for 26 separate security flaws in its products. The software giant addressed four zero-day flaws that hackers are already exploiting in the wild, which should get the attention of systems administrators. It was the largest one-day issuance of patches in 18 months for Microsoft, and raises questions about whether the company is headed in the right direction with its security program.

Last week's mega release was the biggest for 2008, and the largest since February 2007, when Microsoft issued 12 patches for 20 flaws, including seven zero-days. Prior to last week's haul, February 2008's Patch Tuesday yield of 11 fixes for 17 flaws was the most of the year.

"Summer vacation is over a little early for network security professionals," quipped Don Leatham, director of solutions and strategy for Lumension Security, a provider of patch management solutions. "After a light July, the August patch Tuesday will be a very busy one."

Originally, Microsoft planned to issue 12 patches, including seven deemed critical, the most serious rating by the vendor. (Microsoft will change its rating system this fall.) But when the patches came out, there were only 11 patches for six flaws. The vendor also revised security for patches previously released in what was a very busy day for the folks in security at the Redmond, Washington, company.

But missing was a fix for a critical Windows Media Player update, which Microsoft said it needed more time to develop. It almost would have better if Microsoft hadn't even mentioned the upcoming Media Player patch, says Tyler Reguly, a security engineer with nCircle, a network security firm that also reaches out to the media to provide commentary once a month on Patch Tuesday.

"Since this was originally marked critical, it's not good that it's pulled," Reguly says. "The bad thing about Microsoft announcing a patch and then pulling it is that it let's everyone know where to look and that there is something there to be found. It's like being given a treasure map that's half completed … there's still a lot of space to cover, but it's significantly smaller than if you had no insight at all."

More than half of last week's patches are replacements of old patches going back to 2003. While replacement patches are common, it's unusual for there to be so many in a single month, says Andrew Storm, director of security at nCircle. "This is likely the result of Microsoft fixing old patches that didn't cover every exploit avenue and new bugs occurring in the same pieces of code," he says.

Microsoft is confident it has squashed a variety of security problems with the remaining patches. The fixes are aimed at flaws primarily in client-side applications, such as Excel, Word, Access, PowerPoint, Outlook Express, Messenger, and Internet Explorer versions 5 through 7. Flaws were also patched in all recent versions of Windows--from Windows 2000 through Windows Vista and Windows Server 2008.

Microsoft also re-released an old patch: MS08-022, a fix for a scripting flaw that Microsoft originally issued in April. It also updated some of its security tools, providing a clean-sweep (we hope) of its security housekeeping chores.

Four zero day flaws were patched. Two of them--the critical ActiveX vulnerability in Access patched with Microsoft Security Bulletin MS08-041, and the Word remote execution vulnerability patched with Microsoft Security Bulletin MS08-042--are already being actively exploited, according to Amol Sarwate, manager of vulnerability research at Qualys.

Sarwate says two other flaws that hackers were not actively exploiting--at least as of last week--included an HTML objects memory corruption vulnerability patched with Microsoft Security Bulletin MS08-045 (a cumulative IE update) and the Windows Messenger flaw, which was patched with Microsoft Security Bulletin MS08-050.

Reguly, the nCircle security engineer, was curious about Microsoft's treatment of the zero-day Messenger flaw, which could allow an attacker to take nearly total control of a user's Messenger application, including changing state, getting contact information, and initiating audio and video chat sessions without the knowledge of the logged-on user. "This seems fairly serious but has been classified as 'information disclosure,'" Reguly says. "I find this to be extremely strange."

The dominant pattern of client-side vulnerabilities being patched did not change last week, but that doesn't make the Internet any more secure. "We're seeing a lot of the same things we've seen in the past in regards to what's being patched," Reguly says. "Unpatched systems and lack of user awareness coupled with the number of people freely roaming the Internet makes these more profitable and more easily exploitable than the remote attacks from days-gone-by."

However, Microsoft is taking positive steps to change the status quo and trying to get in front of the hackers and their accelerating momentum. Earlier this month at a security convention in Las Vegas, the company announced the Microsoft Active Protections Program (MAPP), a new program designed to facilitate the sharing of exposure-related information with security software vendors, so they can do more to prevent users from falling victim to malicious software and hackers' traps.

Storms applauded the MAPP and its potential to clamp down on security in the long term, but noted there are barriers to adoption.

"While MAPP does help to reduce the risk around 'Exploit Wednesdays,' it has a larger and longer-term objective of building a security community of competing third-party vendors around Microsoft," he says. "If members can look past the competition inherent in their relationships and drink the coalition Kool-Aid, then Microsoft will be the first to build a multi-vendor collaborative environment striving to secure all Microsoft products. This is not something we could have imagined Microsoft doing even a few years ago, and the impact on Microsoft security could be significant."

RELATED STORIES

Microsoft Works to Put the Clamps on 'Exploit Wednesday'

Monster Patch Tuesday Yields 11 Fixes for 17 Flaws

Microsoft Issues a Dozen Security Patches, Fixes Security Tools

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot