It turns out that this February Patch Tuesday is lighter than we had anticipated. Some of the nine bulletins should be less worrisome to IT admins: the Office vulnerability (MS12-015) is in the relatively rare Visio viewer program, MS12-011 is an XSS vulnerability in Sharepoint and MS12-014 and MS12-012 cover DLL preloading vulnerabilities, one in the now deprecated Indeo Codec and the other one in the Color Control Panel. By the way, both are prevented by the recommended work-around for DLL preloading attacks (KB2264107), released in June 2010, which you should have installed already.

Not all of the bulletins are quite so harmless though: MS12-010 fixes four vulnerabilities in Internet Explorer, which have the potential to be used for drive-by-download exploits on IE 7,8 and 9. Last month we saw how quickly attackers could react to new vulnerabilites when exploits for MS12-004 appeared within two weeks of its release on attack sites. So while none of the vulnerabilities in MS12-010 were publicly known, you should install this fix as quickly as possible.

MS12-013 is equally dangerous; attackers can exploit a flaw in a Windows DLL (msvcrt.dll) through a maliciously crafted media file run through Windows Media Player. Include this bulletin in your list of high priorities.

MS12-016 should be broadly considered. It applies to workstations, servers and even Macs; all instances of the .NET framework and Silverlight are vulnerable. Users browsing to malicious webpages can be affected and then allow remote code execution. Server administrators need to take a look: if their users are allowed to upload their own ASP.NET files to run on the machine and if the server runs under a fully trusted setting, the attacker could break out of the ASP.NET sandbox and take control of the server.

Lastly, MS12-009 addresses a vulnerability first blogged about in December 2011 in 64bit Windows 7. A security researcher with the handle w3bd3vil found the flaw through Apple's Safari browser where an overly large IFRAME height attribute causes a crash in the kernel driver win32k.sys. Microsoft believes it is difficult to engineer the code to achieve remote control execution and gives it an exploitability index of 2. Nevertheless you should address it if you are running under that configuration.


Author: Wolfgang Kandek, CTO, Qualys.