(Page 2 of 2)
"If these fonts are embedded in a browser or a Word document, for example, it's rendered in the kernel mode driver and winds up becoming a kernel mode exploit. An authenticated, low-rights user could visit a Web site, the font gets rendered, and it gets rendered as 'system.' This is a very effective attack mode, so Microsoft likes to close out font issues quickly. This is as high a priority as Bulletin 1. Those two bulletins will be the two biggest attack vectors in this batch."
Bulletin 2 addresses two vulnerabilities that are critical remote code executions. This is a Briefcase issue, where you have mapped drives with Briefcase, and Henry classifies it as high priority. Meanwhile, Bulletin 4 affects .Net and fixes Bulletin 5 vulnerabilities in the .Net framework. Bulletin 6 is an Excel vulnerability.
"Bulletin 3 is a moderate update for IIS, which could cause concern. But this is an information disclosure issue via FTP only, so it's only a concern if you have IIS set up to provide FTP services," Henry said. "It's moderate, which typically means attackers have to authenticate to pull off the attack. And we all recognize if they can authenticate, they pretty much own the machine anyway."
|