Microsoft Patch Tuesday Roundup - October 2011
This month Microsoft released 8 security bulletins, including patches for some interesting vulnerabilities. For example, MS11-075, MS11-076, and MS11-077 all address a type of vulnerability triggered by a user accessing a file share. In Microsoft's own words the user must "open a legitimate file that is located in the same network directory as a specially crafted dynamic link library (DLL) file". MS11-077 describes a similar vulnerability, that achieves the same effect using a font file (.fon extension). In all cases, the vulnerability can be triggered when accessing an SMB or WebDAV share. Vulnerabilities such as these allow attackers to compromise vulnerable systems as they are encountered. It can be a difficult problem to solve, as finding all of the files triggering the exploit could be difficult, especially if you have a very large network with several file shares. Of course, the best solution is to apply the patches provided by Microsoft across your environment.
In MS11-082, Microsoft describes "vulnerabilities [that]could allow denial of service if a remote attacker sends specially crafted network packets to a Host Integration Server listening on UDP port 1478 or TCP ports 1477 and 1478." The risk, in Microsoft's eyes, is minimal as "Firewall best practices" should protect you. Firewalls, really? Anyone who's had a user workstation compromised should have realized that firewalls do little to protect the "internal" network.
To help evaluate the vulnerabilities addressed by Microsoft’s Patch Tuesday, Tenable's Research team has published Nessus plugins for each of the security bulletins issued this month:
- MS11-076 - Nessus Plugin ID 56450 (Credentialed Check)
- MS11-077 - Nessus Plugin ID 56451 (Credentialed Check)
- MS11-078 - Nessus Plugin ID 56452 (Credentialed Check)
- MS11-079 - Nessus Plugin ID 56453 (Credentialed Check)
- MS11-080 - Nessus Plugin ID 56454 (Credentialed Check)
- MS11-081 - Nessus Plugin ID 56455 (Credentialed Check)
- MS11-082 - Nessus Plugin ID 56456 (Credentialed Check)
Resources
- Microsoft Security Bulletin Summary for October 2011
- OSVDB Microsoft Bulletins - Complete Reference
- October Update Tuesday: Security Intelligence Report volume 11 announced
Related Articles
Cybersecurity Snapshot: Many Employees Overshare Work Info with AI Tools, Report Finds, as ‘Cybersecurity Awareness Month’ Kicks Off
October 4, 2024Check out the best practices cyber agencies are promoting during Cybersecurity Awareness Month, as a report warns that staffers are feeding confidential info to AI tools. Meanwhile, a study highlights how business decisions can derail OT security. Plus, get the latest on Active Directory security, CISO salary trends and ransomware attacks!
How to Unlock Advanced IoT Visibility for Cyber-Physical Systems
October 1, 2024As the number of IoT devices deployed globally continues to rise, cyber-physical systems and business operations are exposed to greater risk. Improving asset visibility, monitoring and risk management are critical steps to preventing breaches.
Cybersecurity Snapshot: NIST Program Probes AI Cyber and Privacy Risks, as U.S. Gov’t Tackles Automotive IoT Threat from Russia, China
September 27, 2024A new NIST program will revise security frameworks like NIST’s CSF as AI risks intensify. Plus, the U.S. may ban cars with Russian and Chinese IoT components. Meanwhile, the CSA adds AI insights to its zero trust guide. And get the latest on cybersecurity budgets, SBOMs and the Ghost cybercrime platform!