Chuẩn bị sẵn sàng cập nhật cho các bản vá của Microsoft tháng 9

[Anh Le]

Link: http://nakedsecurity.sophos.com/201...emote-code-execution-holes/?utm_source=feedly

In the coming week, Friday falls on the thirteenth day of the month.
That used to be a bad omen in computer security circles, because of the association with computer viruses that deliberately chose that date to unleash their warheads.
These days, however, it doesn't tell you much more than that Tuesday is the Tenth, making it the second Tuesday of the month, and thus a Patch Tuesday.
Get ready: September's Patch Tuesday has 14 bulletins, eight of which are listed as fixing remote code execution vulnerabilities.
The biggie is Bulletin Three, a "spare no versions" Internet Explorer (IE) update.
From IE 6 on Windows XP to IE 10 on Windows 8, including Windows 8 RT, this one hits the Patch Trifecta: it is considered critical, permits remote code execution, and requires a reboot.
At the other end of the risk scale, Server Core installations benefit once again from their reduced attack surface area, with no critical or remotable vulnerabilities reported.
(Windows 2008 R2 Service Pack 1 Server Core will, however, require a reboot to fix an Elevation of Privilege bug listed as important.)
There are four sorts of security flaw patched this month, so let's take this opportunity to revise the implications of each vulnerability type.

Remote code execution​

An RCE is the most serious sort of vulnerability.
It means that content supplied from outside your network, such as a web page or email, can trick your computer into running executable code that would usually require explicit download and installation.
This bypasses any security warnings or "are you sure" dialogs, and can lead to what's called a drive-by download, where just visting a webpage or viewing an image could lead to infection with malware.
RCE example: Anatomy of a buffer overflow.

Elevation of privilege​

EoP vulnerabilities allow a user or process to perform activities usually reserved for more privileged accounts.
Often, an EoP will allow regular users to convert themselves temporarily into an administrator, which pretty much means that all security bets are off.
With administrator privileges, untrusted users may be able to change file access permissions, add backdoor accounts, dump confidential databases, bypass many of the security protections on the network, and even alter logfiles to hide their tracks.
If an EoP vulnerability is combined with an RCE, an attacker may be able to take over your account while you're browsing, and then make the leap to Administrator once they're in.
EoP example: Apple neglects OS X privilege escalation bug.

Information disclosure​

An information disclosure vulnerability, or leak, happens when software inadvertently lets you retrieve data that ought to be protected.
If passwords or similar data are leaked, this could facilitate future attacks; if confidential data is recovered, this could lead to corporate emabrrassment or even data breach penalties.
Leak example: Anatomy of a cryptographic oracle - the BREACH attack.

Denial of service​

A DoS is just what it sounds like: by needlessly consuming computing resources, or by deliberately provoking a crash of vulnerable software, you compromise the availability of a system.
DoSes are often considered to be at the bottom of the severity scale, since they don't usually allow unauthorised access or lead directly to the exfiltration of confidential data.
Nevertheless, DoSes can be very costly, because they may hamper your ability to do business online, cost you revenue, or mask other parts of an attack.

 

Bulletin ID	Bulletin Title and Executive Summary	Maximum Severity Rating and Vulnerability Impact	Restart Requirement	Affected Software
MS13-067	Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2834052)This security update resolves one publicly disclosed vulnerability and nine privately reported vulnerabilities in Microsoft Office Server software. The most severe vulnerability could allow remote code execution in the context of the W3WP service account if an attacker sends specially crafted content to the affected server.	Critical Remote Code Execution	May require restart	Microsoft Office, Microsoft Server Software
MS13-068	Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2756473)This security update resolves a privately reported vulnerability in Microsoft Outlook. The vulnerability could allow remote code execution if a user opens or previews a specially crafted email message using an affected edition of Microsoft Outlook. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Critical Remote Code Execution	May require restart	Microsoft Office
MS13-069	Cumulative Security Update for Internet Explorer (2870699) This security update resolves ten privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Critical Remote Code Execution	Requires restart	Microsoft Windows, Internet Explorer
MS13-070	Vulnerability in OLE Could Allow Remote Code Execution (2876217) This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a file that contains a specially crafted OLE object. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Critical Remote Code Execution	May require restart	Microsoft Windows
MS13-071	Vulnerability in Windows Theme File Could Allow Remote Code Execution (2864063) This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user applies a specially crafted Windows theme on their system. In all cases, a user cannot be forced to open the file or apply the theme; for an attack to be successful, a user must be convinced to do so.	Important Remote Code Execution	May require restart	Microsoft Windows
MS13-072	Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537) This security update resolves 13 privately reported vulnerabilitiesin Microsoft Office. The most severe vulnerabilities could allow remote code execution if a specially crafted file is opened in an affected version of Microsoft Office software. An attacker who successfully exploited the most severe vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Important Remote Code Execution	May require restart	Microsoft Office
MS13-073	Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2858300) This security update resolves three privately reported vulnerabilities in Microsoft Office. The most severe vulnerabilities could allow remote code execution if a user opens a specially crafted Office file with an affected version of Microsoft Excel or other affected Microsoft Office software. An attacker who successfully exploited the most severe vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Important Remote Code Execution	May require restart	Microsoft Office
MS13-074	Vulnerabilities in Microsoft Access Could Allow Remote Code Execution (2848637) This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Access file with an affected version of Microsoft Access. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Important Remote Code Execution	May require restart	Microsoft Office
MS13-075	Vulnerability in Microsoft Office IME (Chinese) Could Allow Elevation of Privilege (2878687) This security update resolves a privately reported vulnerability in Microsoft Office IME (Chinese). The vulnerability could allow elevation of privilege if a logged on attacker launches Internet Explorer from the toolbar in Microsoft Pinyin IME for Simplified Chinese. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights. Only implementations of Microsoft Pinyin IME 2010 are affected by this vulnerability. Other versions of Simplified Chinese IME and other implementations of IME are not affected.	Important Elevation of Privilege	May require restart	Microsoft Office
MS13-076	Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2876315) This security update resolves seven privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs onto the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.	Important Elevation of Privilege	Requires restart	Microsoft Windows
MS13-077	Vulnerability in Windows Service Control Manager Could Allow Elevation of Privilege (2872339) This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker convinces an authenticated user to execute a specially crafted application. To exploit this vulnerability, an attacker either must have valid logon credentials and be able to log on locally or must convince a user to run the attacker's specially crafted application.	Important Elevation of Privilege	Requires restart	Microsoft Windows
MS13-078	Vulnerability in FrontPage Could Allow Information Disclosure (2825621) This security update resolves a privately reported vulnerability in Microsoft FrontPage. The vulnerability could allow information disclosure if a user opens a specially crafted FrontPage document. The vulnerability cannot be exploited automatically; for an attack to be successful a user must be convinced to open the specially crafted document.	Important Information Disclosure	May require restart	Microsoft Office
MS13-079	Vulnerability in Active Directory Could Allow Denial of Service (2853587) This security update resolves a privately reported vulnerability in Active Directory. The vulnerability could allow denial of service if an attacker sends a specially crafted query to the Lightweight Directory Access Protocol (LDAP) service.	Important Denial of Service	May require restart	Microsoft Windows

http://technet.microsoft.com/en-us/security/bulletin/ms13-sep