Microsoft has released 10 security updates fixing a record number of Patch Tuesday holes, including one for a critical hole in Internet Explorer 8 that was exploited as part of a hacking contest at CanSecWest in March.
The bulletin addresses 31 vulnerabilities. "It's the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003," a Microsoft spokesman said.
The June security Patch Tuesday bulletin resolves eight vulnerabilities in IE, the more severe of which could allow remote code execution if a user views a specially crafted web page. The IE8 vulnerability does not affect Windows 7 RC (build 7100), but does affect Windows 7 beta.
The updates also plug two critical holes in implementations of Active Directory on Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode installed on Windows XP Professional and Server 2003, the worse of which could allow an attacker to take control of a system remotely.
The security update fixes three critical vulnerabilities in Windows Print Spooler that could allow remote code execution if an affected server received a specially crafted RPC (remote procedure call) request.
Several vulnerabilities in Office Word and Excel are addressed in the update that could allow an attacker to remotely run code or take control of the machine using a specially crafted Word or Excel file. The update fixes the PowerPoint vulnerability Microsoft warned in April was being exploited in limited, targeted attacks that was fixed in the Windows version last month.
The update includes a patch for an important hole in its IIS Web server product that Microsoft reported in May.
"We didn't see any in-the-wild exploitations of the [IIS WebDav] vulnerability but typically when Microsoft releases those alerts they're doing it because a customer [has alerted them to an exploit]," said Steve Manzuik, senior manager of security research at Juniper Networks.
Also fixed is a critical vulnerability in Microsoft Works Converters, important vulnerabilities in RPC and Windows Kernel. And Microsoft fixed a moderate vulnerability in Windows Search that could allow information disclosure if a user performs a search that returns a specially crafted file as the first result, or if the user previews a malicious file from the search results. By default, the Windows Search component is not preinstalled on Windows XP and Server 2003.
Products affected by the updates include Windows 2000, XP, XP Professional edition, Vista, Server 2003, Server 2008; Office 2000, 2003, 2007 and XP; and Microsoft Office 2004 and 2008 for the Mac.
Other affected software includes Office Excel Viewer; Office Word Viewer; Office Compatibility Pack for Word, Excel and PowerPoint 2007 File Formats; Works 8.5 and 9.0; and Office SharePoint Server.
The updates did not include a fix for a vulnerability in Microsoft's DirectX streaming media technology in Windows disclosed late last month that could allow someone to take complete control of a computer using a maliciously crafted QuickTime file.
"They probably didn't have time to QA [quality assurance test] it adequately," said Wolfgang Kandek, chief technology officer at Qualys. "It doesn't surprise me because look at how many vulnerabilities they had in this release. It must have been an enormous workload for these teams to fix all of these."
Adobe also issued security updates for Adobe Reader and Acrobat versions 7.x, 8.x, and 9.x for Windows and Macintosh on Tuesday in its first quarterly security update for its popular software for creating and reading PDF files.
The updates, available from Adobe, resolve critical vulnerabilities in Adobe Reader 9.1.1 and Acrobat 9.1.1 and earlier versions that could cause the application to crash and could potentially allow an attacker to take control of the system.
Talkback
In amongst the long list of patches for this patch Tuesday, there are six critical patches that IT departments should definitely address for their organisations. Some require prioritisation, and swift action.
MS09-019 is the most important in that it addresses seven separate vulnerabilities across Internet Explorer 6 and 7 for both XP and Vista. This means that almost all Windows users will soon be vulnerable while browsing the web. Two of the vulnerabilities that this update addresses are rated “1” on Microsoft’s “Exploitability Scale” meaning that exploits are likely. These vulnerabilities are in the DHTML and HTML object handling capabilities of Internet Explorer, the core technologies in almost every web page. Additionally, this patch requires a reboot so there is an additional level of complexity in ensuring that this patch is fully deployed across the enterprise.
As MS09-018 addresses an Active Directory vulnerability that is rated a 1 on the exploitability scale and addresses a key infrastructure service, it should also be prioritised. It addresses a “critical” remote code execution for Windows Server 2000 and “important” denial of service vulnerabilities on more recent Microsoft server platforms, something to be avoided on an organization’s directory services infrastructure!