December Patch Tuesday has a flurry of exploits and public disclosures. Coming in to Patch Tuesday, we already had one zero day from Mozilla (CVE-2016-9079) which updated on November 30. Today, Adobe released nine bulletins, including a critical update for Adobe Flash that resolves a zero day (CVE-2016-7892). Microsoft is updating Flash for IE and also has five publicly disclosed vulnerabilities being resolved.
Starting with Firefox, Mozilla announced an update on November 30 that resolved a zero day in SVG Animation. This was identified in attacks targeting unmasking users of the Tor anonymity network. In an article from ZDNet, there was speculation from researchers that this exploit was very similar to an exploit known to have been used by the FBI back in 2013 that was used to unmask IP addresses of Tor users.
Today Mozilla is releasing version 50.1, which includes the Zero Day fix from 50.0.2, which released a couple weeks ago. If you have not already done so, ensure that Firefox is on your priority list this month.
Adobe has released nine bulletins today, but only one is rated as critical. I am sure most of you have guessed that it is for Flash Player and also includes a zero day. APSB16-39 resolves 17 total vulnerabilities and the exploited CVE-2016-7892, which has been used in limited targeted attacks against Windows systems running Internet Explorer (32-bit).
According to an article from Threat Post, analysts from the Google Threat Analysis Group discovered the vulnerability and privately disclosed details to Adobe. Adobe did not have details around the specific attack and the Google researches have not disclosed any more detail publicly at this time.
As always, when there is a Flash Player update, you need to make sure to update all instances of Flash on systems. This means Flash plug-ins for IE, Chrome and Firefox. Some of these will auto update, others may take some prodding before they will update. This is why having a solution that can scan for all four variations is critical to make sure you have plugged all the vulnerabilities in your environment.
On to Microsoft. Microsoft has released a total of 12 bulletins, six of which are critical. Microsoft is resolving 42 unique vulnerabilities this month.
Aside from Flash for IE, Microsoft does not have any additional zero days to report, but they do have several public disclosures. A public disclosure means that enough detail has been released to the public to give a threat actor a jump start in developing an exploit. This puts their vulnerabilities at higher risk of exploit.
MS16-144 is a critical update for Internet Explorer that resolves eight vulnerabilities, three of which are publicly disclosed (CVE-2016-7282, CVE-2016-7281, CVE-2016-7202). Many of the vulnerabilities resolved in this update target a user through specially hosted websites and ActiveX controls and through taking advantage of user-provided content or advertisements or compromised websites.
MS16-145 is a critical update for the Edge browser that resolves 11 vulnerabilities, three of which are publicly disclosed (CVE-2016-7206, CVE-2016-7282, CVE-2016-7281). Similar to the IE vulnerabilities, many of the vulnerabilities resolved in this update target a user through specially hosted websites and ActiveX controls and through taking advantage of user-provided content or advertisements or compromised websites.
MS16-146 and MS16-147 are both rated as critical and affect components of the Windows Operating System. Both resolved vulnerabilities that would target a user and can be mitigated by running as less than a full administrator on the system.
MS16-148 is a critical update for Office, Sharepoint and Web Apps that resolves 16 vulnerabilities. Many of the vulnerabilities resolved in this update can target a user through specially crafted files. An attacker can also host specially crafted web content to exploit many of these vulnerabilities. CVE-2016-7298 is also able to use the Preview Pane as an attack vector.
MS16-155 is an important update for .Net Framework and resolves one vulnerability. Although only rated as important, this bulletin resolves a vulnerability that has been publicly disclosed (CVE-2016-7270), putting it at higher risk of being exploited.
There are additional bulletins from Adobe and Microsoft this month, but these are the bulletins that should be on your priority list for December.
As always, we will be running our monthly Patch Tuesday webinar, where we will go deeper into the bulletins released and recommendations to prioritize what updates need to be put in place sooner than others. Make sure to sign up for the December Patch Tuesday webinar to catch playbacks of previous months and get access to our infographics and presentations to give you the information you need going into your monthly maintenance. www.shavlik.com/Patch-Tuesday
It’s Election Day! I hope you all voted or will be hitting the polls soon, as this election round has been one for the history books. November 8 also happens to be Patch Tuesday. While this is notably of far less concern than hitting the polls today, Patch Tuesday will be delivering updates from Microsoft, Adobe and Google this month and will, unfortunately, still require your attention tomorrow and in the weeks to come.
Microsoft has released 14 bulletins, six of which are rated as critical, resolving 68 unique vulnerabilities. Two of the vulnerabilities have been exploited in the wild (Zero Days), and three of the bulletins contain public disclosures.
First off, we will get a little closure on the Adobe Flash/Microsoft Zero Day that was identified in October and to which Flash released an update on October 26 which resolved CVE-2016-7855. Microsoft has resolved CVE-2016-7255 as part of MS16-135.
Adobe has released another Flash Player update (which is rated as a priority one and resolves nine CVEs. If you haven’t already pushed the Flash update from October 26, ( ) this will be a high priority along with MS16-135.
Microsoft has a second Zero Day vulnerability this month (CVE-2016-7256). MS16-132 resolves an open type font vulnerability that can allow an attacker to remotely execute code. An attacker can target a user to exploit this vulnerability by crafting a document designed to exploit the vulnerability or by hosting a specially crafted website designed to exploit the vulnerability. The attacker would need to convince a user to click on or open the specially crafted content, but that’s really not a significant challenge. This bulletin should also be a high priority this month.
There are a number of public disclosures this month across several bulletins, which means enough information has been leaked to the public to give an attacker a head start on developing exploit code. This increases the risk of exploit occurring for these vulnerabilities so we raise the risk level and priority of bulletins that contain public disclosures. See our Patch Tuesday infographics for more detail.
- MS16-129 for the Edge browser resolves CVE-2016-7199 and CVE-2016-7209
- MS16-135 for Windows resolves CVE-2016-7255 (which has already been exploited)
- MS16-142 for Internet Explorer resolves CVE-2016-7199
Google Chrome went to beta last Wednesday. That along with another Flash Player update means we should expect a Chrome update in the foreseeable future. There is a chance it will come tonight, but it’s more likely to come in the next week. As always you will want to be sure that you have updated Chrome to support the latest Flash Player Plug-In.
If you have not already done so, you will want to make sure to include the Oracle updates from their Q4 CPU that released in October. This included a Critical Java JRE update as well as many other Oracle products.
November also marks the second month of the new servicing model. Here is what you should expect for actual packages to be deployed this month.
The Security Only Bundle (SB16-002) will include the following bulletins: MS16-130, MS16-131, MS16-132, MS16-134, MS16-135, MS16-137, MS16-138, MS16-139, MS16-140 and MS16-142.
The monthly rollup (CR16-002) will include the following bulletins in addition to quality fixes and previous months’ updates: MS16-130, MS16-131, MS16-132, MS16-134, MS16-135, MS16-137, MS16-138, MS16-139, MS16-140 and MS16-142.
As always, we will be running our monthly Patch Tuesday webinar where we will go deeper into the bulletins released and recommendations to prioritize what updates need to be put in place sooner than others. Make sure to sign up for the November Patch Tuesday webinar to catch playbacks of previous months and get access to our infographics and presentations to give you the information you need going into your monthly maintenance. www.shavlik.com/Patch-Tuesday
Since October Patch Tuesday there has been a lot of activity. Oracle released their quarterly CPU including an update for Java JRE, Adobe resolved a Zero Day in Flash Player, our tip of the month, and a quick look at what to expect next week as Patch Tuesday hits.
On the Horizon
Actually more of a continuation from last month. On October 17th Oracle released their quarterly CPU including an update for Java JRE resolving seven vulnerabilities. All seven are remotely executable without the need for authentication and three of these have a CVSS score of 9.6. Java was actually on the lower end of total vulnerabilities addressed in an individual Oracle product for this CPU. Ensure to include this update in your November testing if you have not already deployed it out.
Later in the month Adobe released a Critical Update for Flash Player resolving a Zero Day vulnerability (CVE-2016-7855). On October 26th Adobe released the update for Flash Player (APSB16-36) which started the clock for all the other vendors using the Adobe Flash Plug-In. When a Flash update occurs the plug-ins for Internet Explorer, Firefox, and Chrome also need to be updated.
Firefox uses the NPAPI version of Flash which was also released on the 26th. The update for Flash for IE (MS16-128) released on October 27th plugging the Flash vulnerability. Google Chrome has two install options for Flash, one which relies on Chrome updating. If you are using the Pepper Plug-In it was released on October 26th. If you are using the traditional plug-in, this requires Google Chrome to be updated which occurred on November 1st.
In October, Microsoft changed their servicing model for pre-Windows 10 systems. I covered this extensively in a previous blog post, but there is a little ambiguity with Server 2016’s servicing model options. In a blog post from Microsoft they talk about a Security Only and a Security Quality option each month. This statement specifically caused several people to ask me some questions about how exactly Microsoft is handling updates on Server 2016.
“You can then have the flexibility to choose the security only update, or the quality update to build your patch management strategy around.”
The reality right now is Server 2016 updates are exactly like Windows 10. Cumulative bundles that include all updates that came before. It will be interesting to see if a Security Only option does make itself available in November or sometime in the near future. I expect a number of Microsoft customers would appreciate Security Only as an option for Server 2016.
Patch Management Tip of the Month
Exceptions: You can never push all patches. There is always an update that will conflict with business critical apps which cause exceptions. Documenting these exceptions and the reason they occurred is very important, but documenting an exception is just the beginning.
With each exception you are increasing risk. Each exception is an exposure that will potentially allow malware or ransomware into your environment or allows a threat actor to gain a foothold or move closer to proprietary information or user data. With an exception you should also identify mitigating steps to reduce the risk. This may come in many forms, but here are some examples:
- Least Privilege Rules will often mitigate the impact if an attacker is able to exploit a vulnerability. If you take a look at our Patch Tuesday infographics on our Patch Tuesday page you will see a column labeled “Privilege Management Mitigates Impact”. These vulnerabilities will only gain the attacker equal rights as the user who is exploited. If they are a full Administrator the attacker gains pretty much full access to the system. If they are running reduced privileges then the attacker must use an escalation of privilege vulnerability to gain sufficient permissions to do more.
- Application Control will allow you to control what applications can be installed or run on a system and can effectively block most malware, ransomware, and other forms of attack. Application control can take many forms like Whitelisting or Blacklisting. These would be static application controls. More dynamic forms would include Trusted Ownership or Trusted Vendor rules. These are significantly easier to implement and maintain and also allow you to more easily rollout an effective Application Control Policy. The dynamic approaches are less commonly found, but we have a solution that can help there.
- Containerization can effectively contain the more highly vulnerable user experiences like browsing the web and accessing email. Anything that occurs during these user experiences happens in a virtual container. If you have an exception on the system that is exposed by a phishing attack or drive by download the malicious payload whether a malvertising attack, ransomware, or some other form of malware would execute in the container and be separated from the physical system. Close the container (Browser or email, etc) and the threat goes away.
There are many other strategies to reduce exceptions from exposing too much risk like moving the sensitive application into a virtual environment and locking down access to that system to only require users, but this gives you some ideas. With every exception we recommend documenting the reason why it was made and the additional steps taken to reduce risk to the system.
Your Patch Tuesday Forecast
We are less than a week away from Patch Tuesday and as you can see there is a significant buildup of issues to deal with already. I would forecast that the 3rd party front is going to be lighter than normal for Patch Tuesday and we can expect an average workload from Microsoft on the order of ten or so bulletins total being released.
As always, join us for our Monthly Patch Tuesday Webinar next Wednesday November 9th as we delve deeper into the bulletins and vulnerabilities resolved on Patch Tuesday.
October Patch Tuesday will see some changes to how Microsoft and Adobe will be distributing updates. There is a lot of buzz regarding Microsoft’s servicing changes to pre Windows 10 systems. October Patch Tuesday is the first release under this new servicing model, which we will talk about more in a moment. There are a few changes for Adobe Flash Player starting this month that you will need to be aware of. We are expecting a Google Chrome release today and Oracle’s Quarterly CPU next week, so plan on updates for Java JRE and many other Oracle solutions.
Regarding Microsoft’s servicing model changes, Microsoft has basically consolidated all IE and OS bulletins into a single update. This will be served up in one of two ways: as a security only quality update or a security monthly quality rollup. The biggest difference between these is the security only is bundling each month’s security updates only. The rollup includes non-security fixes as well as being cumulative. I recently spoke with LANDESK CSO Phil Richards about this change and he provided some good feedback as far as the challenges companies may face. In last week’s Patch Tuesday Forecast, I also talked about some recommendations on how best to choose between the security only and the rollup options.
Adobe has changed their distribution for Flash Player, so you would need to get an agreement in place with Adobe to be able to get access to the Flash Player distribution page. Today also marks the final release of Flash Player ESR. So instead of a current branch and stable branch, Adobe will just have current branch. Since they are doing fewer feature changes to Flash Player, having a single branch simplifies their release model. The new distribution page included this notification:
Oracle’s Quarterly CPU is coming next week on the 18. Oracle releases on the first month of each quarter on the Tuesday nearest to the 17, which typically falls the week after Patch Tuesday. Watch for an update next week for Java and many other Oracle products.
Google Chrome should be releasing today. The Dev channel for Chrome Desktop updated late last week which usually indicates a Chrome release on Patch Tuesday or soon after. With a Flash Player update, they will be releasing to support the latest plug-in, but likely will have some additional security fixes as well.
Let’s break down the more severe of these bulletins.
Looking at the infographic you would see that Microsoft has released 10 bulletins today — five of which are rated as critical — and there are four unique Zero Day exploits across five of the bulletins. Now there are 10 bulletins, but the actual number of deployable packages is less. There will be the security only or security rollup, which will bundle MS16-118, MS16-120, MS16-122, MS16-123, MS16-124, MS16-125 and MS16-126 together in a single installer. For systems where you have installed a newer version of .Net you will have the .Net Rollup. Skype, Lync, Office and Flash are separate updates yet. So you could have as many as seven packages to deliver to some endpoints, but most will be getting around five actual packages to test.
MS16-118 is a critical update for Internet Explorer. This bulletin resolves 11 vulnerabilities including one Exploit in the Wild (CVE-2016-3298). There are multiple vulnerabilities in this bulletin that are user targeted, meaning the attacker can convince a user to open specially crafted web content to exploit the vulnerabilities. Several of the vulnerabilities can also be mitigated if the user is running as less than a full administrator, the attacker would only gain equal rights to the user reducing the impact if exploited.
MS16-119 is a critical update for Edge browser. This bulletin resolves 13 vulnerabilities including one Exploit in the Wild (CVE-2016-7189). Many of the vulnerabilities resolved in this bulletin are user targeted. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.
MS16-120 is a critical update for .Net Framework, Office, Skype for Business, Lync and Silverlight. The bulletin resolves seven vulnerabilities including one Exploit in the Wild (CVE-2016-3393). This bulletin includes vulnerabilities that are user targeted. An attacker can host specially crafted web content or specially crafted document file designed to exploit the vulnerabilities. One of the vulnerabilities (CVE-2016-3396) can also be exploited through the Outlook Preview Pane. Users running with reduced privileges could reduce the impact if exploited.
MS16-121 is an important update for Office. The bulletin resolves one vulnerability, which has been Exploited in the Wild (CVE-2016-7193). An attacker could craft a file to send through email or by specially crafting web content designed to exploit the vulnerability. Users running with reduced privileges could reduce the impact if exploited.
MS16-122 is a critical update for Windows. The bulletin resolves one vulnerability. An attacker could exploit this vulnerability by convincing a user to open a specially crafted file from a webpage or an email message. The Outlook Preview Pane is an attack vector for this vulnerability. Users running with reduced privileges could reduce the impact if exploited.
MS16-126 is a moderate update for Windows. The bulletin resolves one vulnerability, which has been Exploited in the Wild (CVE-2016-3298). This is the same CVE ID as the Exploit in MS16-118 for Internet Explorer. To fully resolve the vulnerability, both MS16-118 and MS16-126 must be installed. For Windows Vista and Server 2008, this means installing two separate packages. For newer Oss, both will be included in the security only or security rollup package.
MS16-127 is a critical update for Flash Player for Internet Explorer. This update resolves 12 vulnerabilities in Adobe Flash Player Plug-In for Internet Explorer. To fully resolve Flash Player vulnerabilities you must install updates for Flash Player, Flash for IE, Flash for Chrome and Flash for Firefox, so this could be multiple installable updates on a single system.
APSB16-32 is a priority one update for Adobe Flash Player. This update resolves 12 vulnerabilities. Many of the vulnerabilities are user targeted and, if exploited, could allow an attacker to take control of the affected system.
For more in depth analysis and conversation regarding this Patch Tuesday, join us for the Shavlik Patch Tuesday Webinar tomorrow morning.
Patch Tuesday September 2016
This September 2016 Patch Tuesday will be the final Patch Tuesday on the old servicing model. Starting in October Microsoft has announced a change to the servicing models for all pre-Windows 10 operating systems. I have had a number of questions from customers, partners, other vendors and companies I have spoken to since the announcement. My advice remains the same, which I describe in this post. This change will require all of us to make some adjustments, and application compatibility and the risks associated with exceptions are the areas that will be most impacted.
I went through an exercise earlier today to show what I mean.
If you look at the average bulletin and vulnerability counts for each Patch Tuesday this year we are averaging about three CVEs per bulletin. Given the explanation from Microsoft’s blog post I revisited each Patch Tuesday for 2016 and refigured the total bulletin count we would have seen in under the new model and the average CVEs per bulletin changes to around 12 CVEs per bulletin.
The bottom line here is exceptions due to application compatibility issues will become more compounded from a risk perspective. Companies will have to do more rigorous application compatibility testing to ensure things to don’t break when these larger bundled security updates are pushed to systems. If there is a conflict, vendors that conflict with the updates are going to be under more pressure to resolve issues. Where companies may have accepted an exception for one or two vulnerabilities, an exception that causes 20 vulnerabilities to go unpatched will have a very different reaction.
Next month as we investigate the October Patch Tuesday release we will have more details, and will discuss the realities of the new servicing model in our monthly Patch Tuesday webinar, so plan to join us for that.
My forecast for this Patch Tuesday was pretty close. There’s the Flash Player update and 14 bulletins from Microsoft. Microsoft’s 14 bulletins include seven critical and seven important updates resolving a total of 50 unique vulnerabilities, including an IE zero day (CVE-2016-3351) and a public disclosure (CVE-2016-3352).
Adobe released a total of three bulletins, but only Flash Player was rated as critical or priority 1 in Adobe severity terms. This update resolves 29 vulnerabilities. The other two Adobe bulletins resolve nine vulnerabilities, but both are rated Priority 3, which is the lowest rating Adobe includes for security updates.
As I mentioned last week, Google also recently released a Chrome update, so be sure to include this browser update in your monthly patch maintenance as it includes additional security fixes.
Digging in a layer deeper on higher priority updates:
MS16-104 is a critical update for Internet Explorer that resolves 10 vulnerabilities, including a zero day exploit (CVE-2016-3351), making this a top priority this month. This bulletin includes vulnerabilities that target end users. The impact of several of the vulnerabilities can be mitigated by proper privilege management, meaning if the user exploited is a full user, the attacker also has full rights. If the user is less than a full user, then the attacker must find additional means to elevate privileges to exploit the system further.
MS16-105 is a critical update for edge browser that resolves 12 vulnerabilities. This bulletin includes vulnerabilities that target end users, and the impact of several of the vulnerabilities can be mitigated by proper privilege management.
MS16-106 is a critical update for Windows Graphics that resolves fives vulnerabilities. GDI patches often impact more than just the Windows OS, as GDI is a common component used across many Microsoft products. This month it appears the GDI update is only at the OS level, which I believe was a first this year.
MS16-107 is a critical update for Office and SharePoint which resolves 13 vulnerabilities. Now when I say this affects Office and SharePoint, I mean ALL variations — all versions of Office, Office Viewers, SharePoint versions including SharePoint 2007. You may see this show up on machines more than once depending on what products and viewers are on each system. This bulletin includes vulnerabilities that target end users, and the impact of several of the vulnerabilities can be mitigated by proper privilege management.
MS16-108 is a critical update for exchange server that resolves three vulnerabilities. In reality, this update addresses more, as it includes Oracle Outside in Libraries which released an update in July. This adds 18 additional vulnerabilities to the resolved vulnerability count for this bulletin. This bulletin does include a user targeted vulnerability. An attacker could send a link that has a specially crafted URL which would allow redirection of an authenticated exchange user to a malicious site designed to impersonate a legitimate website.
MS16-110 is an important update resolving four vulnerabilities. Now, you may be asking, why include this one important update in the high priority updates for this month? Well, that is because of CVE-2016-3352, which was publicly disclosed. This means enough information was disclosed before the update was released, giving attackers a head start on building exploits. This puts this bulletin into a higher priority, as it stands a higher chance of being exploited. The vulnerability is a flaw in NTLM SSO requests during MSA login sessions. An attacker who exploits this could attempt to brute force a user’s NTLM password hash.
MS16-116 is a critical update in VBScript Scripting Engine that resolves one vulnerability. This update must be installed along with the IE update MS16-104 to be fully resolved. This bulletin includes vulnerabilities that target end users and the impact of several of the vulnerabilities can be mitigated by proper privilege management.
MS16-117 is a critical update for Adobe Flash Player plug-in for Internet Explorer. This bulletin resolves 29 vulnerabilities, several of which do target a user.
APSB16-29 is a priority 1 update for Adobe Flash Player that resolves 29 vulnerabilities. With Flash Player updates you will typically have two to four updates to apply to each system. Flash Player and plug-ins for IE, Chrome, and FireFox.
For more in depth analysis and conversation regarding this Patch Tuesday, join us for the Shavlik Patch Tuesday Webinar tomorrow morning.
I am chilling up in Daresbury, UK this Patch Tuesday, so instead of working through lunch I am working through dinner. ROOM SERVICE! There are two not so very surprising events this evening. First, it is raining in the UK. Second, Adobe Flash Player has a zero day! Like I said, no surprises. CVE-2016-4171 was observed in limited, targeted attacks by Anton Ivanov and Costin Raiu of Kaspersky Lab. Adobe has announced an imminent release of Adobe Flash Player as early as Thursday June 16, so expect that to come later this week.
Of course, along with a Flash Player update, you should also expect updates to Chrome, Firefox and IE to support the latest plug-in. Also of note, Adobe has announced that the Flash Player distribution page will be decommissioned on June 30, 2016. The urging is for companies to distribute Flash Player to get a proper enterprise agreement in place to distribute Flash Player. Most of you, however, are only concerned with updating Flash Player instances in place for any reason other than your willingness to distribute it intentionally.
For personal use, users are directed to go to https://get.adobe.com/flashplayer/. Businesses looking to distribute Adobe Flash Player internally must have a valid license and AdobeID to download and distribute Flash Player binaries. For more instructions, go to http://www.adobe.com/products/players/flash-player-distribution.html.
Microsoft has released 16 bulletins currently, but with Flash Player releasing later this week there will be 17 total. Of the current 16, five are rated as critical, and the Flash for IE bulletin will also be critical. Altogether, Microsoft is addressing 36 unique vulnerabilities. The overall count across all bulletins is 44, but some of these are across common components used by many products.
I am going to talk about two things in particular in many of the bulletins below. User targeted vulnerabilities and vulnerabilities where privilege management can mitigate the impact if exploited.
User-targeted vulnerabilities are vulnerabilities that would require an attacker to convince the user to click on specially crafted content like an ad in a webpage or an attacked image or PDF. The exploited would be embedded in this specially crafted content allowing the attacker to exploit a vulnerability in the software that is rendering the file. This is a common form of attack to gain entry to a network, since all the attackers need is enough users in that network before they will convince one of them to open their crafty content. Phishing research, described in the Verizon 2016 Breach Investigation Report, states that 23 percent of our users will open a phishing email and 11 percent will open the attachment. If an attacker finds a list of about 10 of your users, they have roughly 90 percent chance of exploiting one of them and getting into your network.
Privilege management can mitigate the impact if exploited. This is a case where the vulnerability does not give the attacker full rights to the system. Instead, they are locked into the context of the user who was logged in. This situation means that if the user is running as less than a full admin, the attacker will have limited capabilities to do anything nefarious.
Many of the bulletins released by Microsoft include vulnerabilities that fit one of both of these categories. MS16-063 is a critical update for Internet Explorer that includes fixes for 10 vulnerabilities. Several of these are targeting a user, and several can be mitigated by limiting user privileges to less than a full admin.
MS16-068 is a critical update for the Edge browser that includes fixes for eight vulnerabilities. This update also includes one public disclosure (CVE-2016-3222). Public disclosures indicate a higher risk of being exploited, as an attacker has some foreknowledge of the vulnerability, giving them a head start on developing an exploit before you can get the update in place. Statistically, this puts it at higher risk of being exploited. Several of these are targeting a user and several can be mitigated by limiting user privileges to less than a full admin.
MS16-069 is a critical update for Windows that includes fixes for Jscript and VBScript for three vulnerabilities. Several of these are targeting a user, and several can be mitigated by limiting user privileges to less than a full admin.
MS16-070 is a critical update for Office and Sharepoint that includes fixes for four vulnerabilities. Several of these are targeting a user and several can be mitigated by limiting user privileges to less than a full admin.
The last of the critical updates this month, MS16-071, is an update in DNS, which includes one fix.
There are three more bulletins of note. Each of these includes a vulnerability that has been publicly disclosed.
MS16-075 (CVE-2016-3225), MS16-077 (CVE-2016-3236) and MS16-082 (CVE-2016-3230). These are all rated as important, but due to the public disclosures, they should warrant more immediate attention.
For a deeper dive into the full Patch Tuesday release, join me tomorrow for the Shavlik Patch Tuesday webinar. I will have a special guest, Gary McAllister from AppSense, who will be discussing concerns around user targeted vulnerabilities and vulnerabilities that can be mitigated with proper privilege management.
May’s Patch Tuesday has a few juicy surprises for us. On the Microsoft side, there is one vulnerability being exploited in the wild that affects both Internet Explorer (MS16-051) and Windows (MS16-053). Additionally, two public disclosures will raise concerns with Internet Explorer (MS16-051) and .Net Framework (MS16-065). We also have a Zero Day in Flash Player from Adobe that has caused some confusion considering Adobe just published an Advisory page (APSA16-02) stating the update resolves CVE-2016-4117, which was reported to Adobe by a researcher at FireEye, a security firm. We are also seeing Microsoft publish MS16-064, a bulletin to update Adobe Flash Player plug-in support for Windows and Internet Explorer; which has details of APSB16-15, including 24 CVEs that will be included in the update. So, the question is, why did Adobe not release the update? Will Microsoft end up pulling the bundled version in MS16-064 when the Adobe bulletin releases next week?
In total, Microsoft released 16 bulletins today, eight critical and eight deemed important. There are also 33 unique CVEs being resolved, including one Zero Day that affects two bulletins and two public disclosures.
Today, Adobe released bulletins for Adobe Reader, Cold Fusion and an advisory for Flash Player that should see a bulletin release as soon as this Thursday. The two bulletins resolve for a total of 85 CVEs. With the addition of Flash Player later this week, if the Microsoft bulletin is accurate, it should bring the total to 109 CVEs resolved from Adobe this month.
MS16-051 is a critical update for Internet Explorer and Windows resolving five total vulnerabilities, including one known exploited (CVE-2016-0189) and one public disclosure (CVE-2016-0188). The vulnerability that has been exploited can be used in user-targeted attacks such as through a specially crafted website designed to exploit the vulnerability through Internet Explorer or ActiveX controls marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine. The attacker gains equal privileges to the logged-on user, so running as less than administrator will mitigate the impact of exploitation.
It is recommended to get your IE updates rolled out quickly this month. For those running less than the latest IE version available for the OS its installed on, be aware that Microsoft reduced support in January to only update the latest version available on supported Operating Systems.
MS16-053 is a critical update for Microsoft Windows that resolves two vulnerabilities, including the known exploited (CVE-2016-0189). This OS update is another that’s recommended to rollout as quickly as possible this month as it affects older versions of the OS and VMScript and JScript versions. The vulnerability that has been exploited can be used in user-targeted attacks such as a specially crafted website designed to exploit the vulnerability through Internet Explorer or ActiveX controls marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine. The attacker gains privileges equal to the logged on user, so running as less than administrator will mitigate the impact of exploit.
The other five critical updates from Microsoft affect Office, SharePoint and Windows OS. These bulletins should be tested and implemented within two weeks to reduce exposure.
MS16-065 is an important update for .Net Framework that includes a public disclosure. It is recommended to add this update to the two-week rollout list this month. A public disclosure means an attacker has additional knowledge, making CVE-2016-0149 more likely to be exploited. The vulnerability is an information disclosure in TLS/SSL that could enable an attacker to decrypt encrypted SSL/TLS traffic. To exploit the vulnerability, an attacker would first have to inject unencrypted data into the secure channel and then perform a man-in-the-middle attack between the targeted client and a legitimate server. On network this may be harder to achieve, but users who leave the network could be at higher risk of exposure to a scenario where this type of attack is possible. Keep in mind, Microsoft recommends thorough testing before rolling out to production environments.
Adobe Reader APSB16-14 is rated as a priority two, but resolves 82 vulnerabilities. By sheer force of numbers, we are suggesting this update be considered a higher priority. As a result, be sure it is tested and put into effect within four weeks.
Adobe Flash Player only released an advisory today, but it included high-level details of a vulnerability that has been detected in exploits in the wild. If information gleaned from MS16-064 is accurate, this Zero Day will be accompanied by 23 additional CVEs, with the release expected on May 12th. With this in mind, the recommendation is to roll this update out immediately.
With Adobe Flash Player it’s important to keep in mind there are multiple updates that need to be installed in order to fully address the vulnerabilities, including Flash Player, Flash Plug-Ins in Internet Explorer (MS16-064), Google Chrome (expect an update when APSB16-15 releases later this week) and for FireFox.
Join us tomorrow for the May Patch Tuesday webinar where we will discuss the bulletins in more detail.
Things were going too smoothly this month, but it did not take long to accumulate some curve balls to make your March patching more interesting.
As we expected, Flash was very close to a release on Patch Tuesday. It’s here and with it Microsoft has released MS16-036, which is the Flash plug-in for Flash Player Security Bulletin. Also, expect ANOTHER Google Chrome update to support the latest Flash plug-in version there as well.
Ok, so APSB16-018: Adobe Flash Player contains 23 vulnerabilities, several of which are critical in nature, but lets focus in on CVE-2016-2010. This vulnerability was reported as being used in limited, targeted attacks. ZERO DAY!
Next lets talk about a stealthy addition to the IE cumulative security update this month. Microsoft has added in another GWX trigger, so your users will get a dialog to upgrade to Windows 10. Check out this post by Rod Trent at WindowsITPro for details. The IE Cumulative KB page states that there are a number of non-security changes in this month’s cumulative and KB3146449 is in the list.
I have been keeping up with a thread on PatchManagment.org regarding this little stealth change, and I can say there are some very displeased people out there. As an aside, one of the comments on Rod Trent’s article recommended this writeup for blocking GWX. We are in no way affiliated with them and I have not personally tested this, but I thought I would share it as I expect people will be looking for ways to prevent their users from getting the dialog at all.
February Patch Tuesday started a bit early with Oracle releasing an out-of-band update for Java to resolve a critical vulnerability that allows DLL Hijacking. Microsoft has released 13 bulletins, six of which are critical, resolving a total of 42 vulnerabilities. Of the vulnerabilities being resolved, two have been publicly disclosed. We also have releases from Adobe for Flash and Photoshop, Mozilla for Firefox, and Google is expected to release a Chrome update with security fixes and support for the latest Flash Plug-In.
Starting with Oracle, the vulnerability resolved by Java 8u73 (CVE-2016-0603) affects many other products, but so far, Oracle and SUSE VirtualBox are the only vendors to release updates to resolve it so far. Researchers are still reporting additional products affected, but the notables include Firefox, Google Chrome, Adobe Reader, 7Zip, WinRAR, OpenOffice, VLC Media Player, Nmap, Python, TrueCrypt, and Apple iTunes. So far there is no confirmation on the Firefox or Chrome releases resolving this vulnerability. Expect to see some more security release in the coming weeks.
As noted, Microsoft has released 13 total bulletins, six of which are rated as critical. Of the 42 vulnerabilities resolved, two have been publicly disclosed – these are part of MS16-014 (CVE-2016-0040) and MS16-015 (CVE-2016-0039). Public disclosures are a risk indicator that we use to rate threat risk, signaling a threat actor has a jump-start on the vendor and is able to exploit the vulnerability before companies can get an update in place. MS16-014 may only be rated as important by Microsoft, but the fact that it has a public discloser means it is at higher risk of exploit.
Here are some things to watch out for this month with Microsoft:
There is a Sharepoint update included in the Office bulletin, MS16-015. I know, all of your Sharepoint admins just cringed, but it has to be updated. This is a critical bulletin and has a publicly disclosed vulnerability, CVE-2016-0039. One of the complicating factors with Sharepoint is the fact that rollback is not an easy thing if something breaks. If you have not already done so, we highly recommend virtualizing your Sharepoint servers so you can take advantage of snapshot capabilities to roll back to a good state, in case something goes wrong.
MS16-014 is rated as important and affects the Windows Operating System. The threat around this bulletin should be considered high, as it does have a public disclosure. CVE-2016-0040 resolves a vulnerability with improper handling of objects in memory by the Kernel. According to the Microsoft bulletin, if exploited “an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” The reason this is likely reduced in severity is because the attacker would need to log on to the system and then run a specially crafted application to exploit the vulnerability.
MS16-018 affects Kernel-Mode Drivers, so both MS16-014 and MS16-018 are making changes to Kernel behavior this month. As always, it is good to test Kernel updates thoroughly before deploying.
One change Microsoft made this month, that I hope is permanent, is making the Adobe Flash Player Plug-In update for Internet Explorer officially a Security Bulletin instead of a Security Advisory. This is a major change to how they have identified the Flash Player Plug-In updates in the past, and one that is warranted, because you have not completely resolved Flash vulnerabilities unless you’ve update the OS and all browser plug-ins. So keep an eye out for MS16-022, which is the critical update for Adobe Flash Player, for all currently supported versions of Windows and IE.
Speaking of Adobe Flash, APSB16-04 is a Priority 1 update resolving 22 vulnerabilities that should be on your priority list this month, especially since Adobe Flash has been highly targeted because it is so widely distributed. Remember, you need to update Adobe Flash, and Flash for IE, Flash for Google Chrome, and Flash for Firefox to completely plug all of these 22 vulnerabilities.
Adobe Photoshop is a Priority 3 update this month that resolves for three lower severity security vulnerabilities.
Mozilla has released Firefox 44.0.1. So far, there’s no report on if security fixes were included in this release or not.
You can also expect to see a Google Chrome release coming out which will be resolve for some security vulnerabilities and will include support for the Flash Player APSB16-04 update. Do make sure this is on your priority list this month.
Join us tomorrow for the February Patch Tuesday webinar where we will discuss the bulletins in more detail.