Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Microsoft December 2012 Black Tuesday Update - Overview - SANS Internet Storm Center SANS ISC InfoSec Forums

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Microsoft December 2012 Black Tuesday Update - Overview

Overview of the December 2012 Microsoft patches and their status.


# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS12-077 Internet Explorer Cumulative Patch
(Replaces MS12-063 MS12-071 )
Internet Explorer 9/10


KB 2761465 No. Severity:Critical
Exploitability: 1
Critical Critical
MS12-078 Windows Kernel Mode Drivers Remote Execution
(Replaces MS12-032 MS12-075 )
Kernel mode drivers
KB 2783534 No. Severity:Critical
Exploitability: 1
Critical Important
MS12-079 Microsoft Word RTF Data Remote Code Execution
(Replaces MS12-064 )
KB 2780642 No. Severity:Critical
Exploitability: 1
Critical N/A
MS12-080 Windows Exchange Server Remote Code Execution
(Replaces MS12-058 )
Exchange Server




KB 2784126 Yes. Severity:Critical
Exploitability: 1
N/A Critical
MS12-081 Windows File Handling Remote Code Execution
(Replaces MS07-035 MS11-063 )
KB 2758857 No. Severity:Critical
Exploitability: 1
Critical Critical
MS12-082 DirectPlay Remote Code Execution
KB 2770660 No. Severity:Important
Exploitability: 1
Critical Important
MS12-083 IP-HTTPS Security Feature Bypass
Direct Access



KB 2765809 No. Severity:Important
Exploitability: 1
Important Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

Post suggestions or comments in the section below or send us any questions or comments in the contact form

John Bambenek
bambenek /at/
Bambenek Consulting


245 Posts
ISC Handler
Given that MS12-083 is for a DirectAccess CA issue and "What systems are primarily at risk from the vulnerability?
Servers are at risk from this vulnerability."
As per that blog post, it's the direct access server that can be tricked into allowing a client into the network that should be revoked. The vulnerability is thusly only on the server side, not a client vulnerability.

Yes if you use a Windows 2012 as a workstation you may be offered up this patch but unless you turn that workstation into a DA authentication server it will never be "vulnerable" to attack. I think your grid does a disservice to the risk rating on the "client side" of Server 2008 r2/Server 2012 as I read this.

34 Posts Posts
V2.0 (December 11, 2012): Added the KB2687627 and KB2687497 updates described in MS12-043, the KB2687501 and KB2687510 updates described in MS12-057, the KB2687508 update described in MS12-059, and the KB2726929 update described in MS12-060* to the list of available re-releases...
The following bulletins have undergone a major revision increment. See the appropriate bulletin for more details.
(Thanks to Susan Bradley...)

160 Posts Posts
The chart indicates that MS12-080 has a known exploit but does not indicate which CVE is impacted. I tried searching and can’t find the vulnerability that has the known exploit. Does anyone know which vulnerability it is (Oracle Outside In or RSS Feed)?


I'm having problem with KB2758857. All of the other patches work fine but that one is causing some programs to crash. (MS Money most notably - yes, I know it's been sunsetted)

I get a C++ runtime error with KB2758857 installed. Removing it gets rid of the problem.

Anyone else?
Known issues with this security update•We are aware of issues related to OpenType Font (OTF) rendering in applications such as PowerPoint on affected versions of Windows that occur after this security update is applied. We are currently investigating these issues and will take appropriate action to address the known issues. "

Official statement by Microsoft showcasing they are aware of the issue and are investigating.

34 Posts Posts
V2.0 (December 20, 2012): Re-released update KB2753842 to resolve an issue with OpenType fonts not properly rendering after the original update was installed. Customers who have successfully installed the original KB2753842 update need to install the rereleased update.

160 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!