Microsoft rolled out 59 vulnerabilities for Internet Explorer in June. But the IE-patching party is not over yet.
Redmond on Tuesday published six new bulletins. Two of them are rated critical and three are rated important. One is classified as moderate. Not surprisingly, the two critical bulletins are a cumulative update for Internet Explorer and a patch for a note-taking app Windows Journal issue that could open the door for attackers.
Meanwhile, the important bulletins tackle flaws in DirectShow, the on-screen keyboard and ancillary function driver, or AFD. The moderate security bulletin addresses a potential denial of service vulnerability in Microsoft Service Bus.
No Time to Relax
We caught up with Craig Young, security researcher at IT security firm Tripwire, to get his thoughts on July’s Patch Tuesday. He told us Windows Server administrators will be relieved that none of the holes Microsoft is plugging this month can be used for remote code execution without user interaction.
“There is a long list of Internet Explorer CVEs as usual but, apart from that, this month is primarily addressing bugs that are more likely to be used after an attacker has gained low privileged code execution,” Young said. “This is not a good reason for security teams to relax this month, though. Microsoft expects all but one of the bulletins will be exploited within the next 30 days, so it’s important to deploy these updates as soon as possible.”
As Young sees it, the critical vulnerability described in MS14-038 is a strong example of how attackers can abuse unused software. He noted that Windows Journal -- which is installed by default but isn’t commonly used -- can lead to arbitrary code execution.
“In this case, attack surface can be greatly reduced by uninstalling the affected software or removing associations with the unused program,” Young said. “One of the best tactics for hardening systems is to remove software or features which are not needed. Doing so protects systems by limiting the lines of code exposed to an attacker and every line of code presents new opportunities for attacks to succeed.”
Limiting the Attack Surface
We also turned to Tyler Reguly, manager of security research at Tripwire, to get his thoughts on Microsoft’s July security bulletins. He told us the bottom line: This month is more of the same from Microsoft.
“Internet Explorer, file type vulnerabilities, and privilege escalation make up most of the list. I'm not sure if this speaks to the maturity of the process or a major flaw with security research,” Reguly said. “It could be that the only bugs left to find exist in this client-side software or it could be that lack of user education and poor computer usage habits make these the most logical targets. I'd like to hope it's the former but I suspect it's the latter.”
Reguly agreed that IT teams should focus on the two critical issues affecting Internet Explorer and Windows Journal. He pointed to workarounds for IT admins who can’t immediately apply updates: a user can switch to a new browser -- making sure to set the new browser as the default -- and disable any Windows Journal .JNT file associations. While a patch is always preferred, he said, limiting the attack surface is a good backup.
“The single remote vulnerability this month affects the little known Microsoft Service Bus offering and is a denial of service vulnerability earning it the lowest patch priority this month,” Reguly noted. “That said, if you use this software, you should patch as soon as possible, attackers could use this vulnerability to disrupt business activities.”