Diary

 

December Black Tuesday Overview
Share |
Published: 2008-12-09,
Last Updated: 2008-12-09 20:36:04 UTC
by Swa Frantzen (Version: 1)
1 comment(s)

Overview of the December 2008 Microsoft patches and their status.

# Affected Contra Indications Known Exploits Microsoft rating ISC rating(*)
clients servers
MS08-070 Multiple vulnerabilities in activeX controls from visual basic 6.0's runtime allow random code execution. Also affects Visual studio, Foxpro, Frontpage, and MS Project. The vulnerable files are distributed with 3rd party applications as well.
Visual Basic Active X

CVE-2008-3704
CVE-2008-4252
CVE-2008-4256
CVE-2008-4253
CVE-2008-4254
CVE-2008-4255		 KB 932349

CVE-2008-3704 Exploit code publicly available since August 2008.

 Critical PATCH NOW Important
MS08-071 Multiple overflow vulnerabilities allow code execution with the rights of the logged on user via crafted WMF files.
Replaces MS08-021.
GDI

CVE-2008-3465
CVE-2008-2249		 KB 956802 No publicly known exploits. Critical Critical Important
MS08-072 A multitude of vulnerabilities allow random code execution in office (and via extension Outlook). Also affects the mac versions of office (Office 2004 and Office 2008).
Replaces MS08-026, MS08-042, MS08-052 and MS08-057.
Word

CVE-2008-4024
CVE-2008-4025
CVE-2008-4026
CVE-2008-4027
CVE-2008-4028
CVE-2008-4030
CVE-2008-4837
CVE-2008-4031

KB 957173

No publicly known exploits.

 Critical Critical Important
MS08-073 Multiple vulnerabilities allow random code execution with the rights of the logged on user.
Replaces MS08-058.
MSIE

CVE-2008-4258
CVE-2008-4259
CVE-2008-4261
CVE-2008-4260		 KB 958215 No publicly known exploits. Critical Critical Important
MS08-074 Multiple vulnerabilities allo allow random code execution in office. Also affects the mac versions of office (Office 2004 and Office 2008).
Replaces MS08-058.
Excel

CVE-2008-4265
CVE-2008-4264
CVE-2008-4266

KB 959070

No publicly known exploits.

 Critical Critical Important
MS08-075 Multiple vulnerabilities allow random code execution with the rights of the logged on user.
Replaces MS08-038.
Windows explorer

CVE-2008-4269
CVE-2008-4268		 KB 959349 No publicly known exploits. Critical Critical Important
MS08-076 Multiple vulnerabilities allow random code execution with the rights of the logged-on user.
WMC (media player)

CVE-2008-3010
CVE-2008-3009

KB 959807

No publicly known exploits.

 Important Critical Important
MS08-077 Bypassing authentication is possible on sharepoint servers.
Replaces MS07-059.
Sharepoint

CVE-2008-4032		 KB 957175 Microsoft's workaround publicizes serious clues on how to attack: "block all HTTP requests to your SharePoint site that contain "mode=ssp" in the URL, but do not contain "/ssp/admin/_layouts" in the URL" Important N/A Critical
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

--
Swa Frantzen -- Section 66

Keywords: black tuesday Microsoft patches
1 comment(s)

Comments

MS08-070 is a mess. If any 3rd-party VB 6 Apps deployed any of the following OCX files to your machine, you are probably vulnerable!

ComCt232.ocx
MSChrt20.ocx
mscomct2.ocx
MSDatGrd.ocx
MSFlxGrd.ocx
MShflxgd.ocx
msmask32.ocx
MSWINSCK.ocx

In addition, Microsoft isn't providing updates for you, but only to the developer that developed the software. I'm planning on hacking up the MSI they are providing to dike around the VB6 detection logic. Have fun!

Personally, I think Microsoft just violated the rules of responsible disclosure!
posted by Anonymous, Tue Dec 09 2008, 23:47
Login here to post a comment. Diary Archive