Microsoft Patches Two Zero-Day Exploits, Leaves Two Untouched

Published: December 13, 2006

by Alex Woodie

Microsoft yesterday released patches for two zero-day exploits, but left two other zero-days unpatched during its final Patch Tuesday of the year. While Microsoft addressed zero-day problems in Windows and Visual Studio 2005 and fixed another critical problem affecting IE versions 5 and 6, it failed to issue patches for two other recently discovered zero-day flaws that affect Word. All told, seven patches were released, fixing 11 vulnerabilities across a range of mostly client-side products.

The most critical patch issued yesterday was Microsoft Security Bulletin MS06-078, which fixes the two "ASF Playlist" security flaws that hackers could use to take full control of an effected system when a user tries to open a malformed Advanced System Format (ASF) file (or sometimes referred to as Advanced Streaming File) on a Web site or in an e-mail.

The ASF Playlist flaw is a zero-day vulnerability that was discovered three weeks ago, and which Microsoft originally had classified, erroneously, as a denial of service threat, according to security researchers eEye Digital Security, which has been tracking the flaw on its new zero-day vulnerability tracker. Microsoft added MS06-78 to the current patch cycle at the last minute, according to eEye.

The other zero-day flaw fixed yesterday is the WMI Object Broker vulnerability in Visual Studio 2005, an active exploit that allows an attacker to take full control of a computer by luring users to a malformed Web page. This vulnerability, which was fixed with Microsoft Security Bulletin MS06-073, is an ActiveX-based exploit, and users who are running IE version 7, especially on Windows Server 2003 or the new Windows Vista, are not as exposed to the problem as users running older versions of IE on workstations. Just the same, it's a serious problem for those computers running Visual Studio 2005.

The final critical patch, Microsoft Security Bulletin MS06-072, is a cumulative patch that fixes four flaws in our old friends, IE versions 5 and 6. Symantec says MS06-072 is the most critical of the bulletins issued yesterday, largely due to the Script Error Handling Memory Corruption, a newly discovered (but privately reported) flaw that can cause "a memory corruption condition when handling script errors in certain circumstances and may result in a complete system compromise," the security giant says. You can bet your bongos evil-doers are itching to explore all the possible ways they can use this new vector to infect your Windows system in the days and weeks to come.

Microsoft did not patch two Word flaws that are making their rounds of the Internet. Microsoft security researchers are aware of the flaws, and even posted Security Advisory 929433 last Tuesday to confirm it's working on a fix for the first flaw, which is infecting users of many current and older Word programs for Windows and the Mac. On Sunday, security researchers confirmed reports of a new flaw affecting Word 2000 with a posting on the Microsoft Security Response Center Blog!. The team managed to work fast to get MS06-078 out the door at the last second, but fixing these new Word flaws was apparently too much to ask.

But Wait, There's More Patches!

Microsoft issued four other patches yesterday for a range of flaws it deems as important. While these flaws don't carry the same urgency as the flaws listed above, they could prove just as dangerous in your shop, as three of them could allow a hacker to take complete control of the system, which usually results in a "critical" rating. These patches include:

• Microsoft Security Bulletin MS06-074, which fixes a newly discovered problem in Windows' SNMP service that could allow attackers to execute their choice of code. However, because SNMP is not activated on Windows by default, this flaw does not pose as great a risk.
• Microsoft Security Bulletin MS06-075, which fixes a newly discovered problem in the way that Windows starts applications with specially crafted file manifests, called the File Manifest Corruption vulnerability. A hacker successfully using this flaw could take complete control of the machine, but he must already have valid log-on credentials, and he can't do it remotely, which is why it rated only "important" on Microsoft's scale. It also only affects Windows XP Service Pack 2 (SP2), Windows Server 2003, and Windows Server 2003 for Itanium-based Systems.
• Microsoft Security Bulletin MS06-076, which is a cumulative update for Outlook Express that also fixes a newly discovered flaw, called the Windows Address Book (WAB) Contact Record Vulnerability, that could allow attackers to take complete control of the system if they got a user to open a malicious WAB file. The flaw rates only an "important" rating because attackers will only gain the rights of the infected user.
• Microsoft Security Bulletin MS06-077, which fixes the newly discovered RIS Writable Path vulnerability in Windows 2000 SP4. The flaw exists in Remote Installation Services (RIS), which Microsoft calls a "pre-boot execution environment" (PXE)-based deployment technology that allows Windows setup to initiate over a network. A flaw in RIS could allow an anonymous user to overwrite existing operating system files or upload a specially crafted file.

Yesterday's patch of patches continues the recent trend that sees hackers poking for holes in desktops and client machines, as opposed to servers. "Today's release from Microsoft reconfirms that client-side vulnerabilities are one of the most efficient and well known methods by which computers can become infected, therefore users are urged to install patches as soon as possible," says Oliver Friedrichs, director, Symantec's security response group.

For the year, Microsoft issued 78 patches for hundreds of vulnerabilities, the largest number of patches the company has ever released. For comparison, the company issued 55 patches in 2005, 45 in 2004, 51 in 2003, 72 in 2002, and 60 in 2001.

Microsoft will be hosting a Web cast today at 11 a.m. PST to discuss the current batch of fixes. To register for the event, go to TechNet Security Center.