Microsoft Targets Two IE Zero-Day Flaws in October Patch Tuesday
On the 10th anniversary of Patch Tuesday, Microsoft released eight security bulletins. Four of the October bulletins are rated Critical and four are rated Important. But the Internet Explorer patch is getting the most attention.
“Microsoft has addressed 27 CVEs this month. Many people will be happy to see MS13-80, a critical patch for 10 vulnerabilities in Internet Explorer 6 through 11,” Paul Henry, a security and forensics analyst at Lumension, told us.
“There are two known attacks underway so the IE patch should be your priority number one. This patches CVE -2013-3893, a zero day vulnerability Microsoft wrote about in Security Advisory 2887505 September 17.”
Why Wasn’t It Released Earlier?
Wolfgang Kandek, CTO at Qualys, told us the discussion around a potential earlier release of MS13-080 depended on the number of ongoing attacks Microsoft and the security community detected. Since the volume continued to stay low, even after Metasploit added its implementation, he explained, Microsoft opted for a normal release schedule during Patch Tuesday. This move places the least stress on IT organizations during a month where there’s plenty of stress already.
MS13-080 also addresses CVE-2013-3897 in an interesting case that Kandek says illustrates the concurrent discoveries of vulnerabilities. Microsoft found the vulnerability underlying CVE-2013-3897 internally and it would have been fixed in MS13-080 as part of the normal security engineering and hardening that the product undergoes constantly, Kandek explained.
“However, in the last two weeks, attacks against the same vulnerability became public, again limited and targeted in scope, but since the fix was in the code already, it enabled Microsoft to address the vulnerability, CVE ID CVE-2013-3897, in record time,” he said. “By the way the same, but less public reasoning about attack volume as for CVE-2013-3893 has been applied in this case as well: If there had been widespread reports of the vulnerability being used to exploit networks, it would have triggered an out-of-band release.”
This One Could Spread Rapidly
Ross Barrett, a senior manager of security engineering at security firm Rapid7, told us MS13-083 looks like a “really fun one.” The security bulletin patches a server-side vulnerability offering remote code execution that is hittable through ASP.net web pages.
“This is a genuine article -- a real, honest-to-goodness, potentially ‘wormable’ condition. If the ‘bad guys’ figure out a way to automate the exploitation of this, it could spread rapidly and the defense in depth measures of your organization will be tested. However, this vulnerability was privately reported to Microsoft and is not known to be under active exploitation,” he said.
“On top of all that, there are four MS Office vulnerabilities. These issues have only been tagged as 'important' for one reason or another. Don't ignore them, but patch the other issues in this month’s advisory first if you have to make that kind of decision,” he added.
A Month of Headaches
Overall, Kandek called October a challenging and busy month with the high priority Internet Explorer patches and the additional patching from Adobe, plus the patches for next week that we can expect for all Oracle products, including Java.
“Our perspective has certainly evolved from 10 years ago when Patch Tuesday was started -- back then vulnerabilities were clear cut and straightforward to understand. Today the amount of complexity that goes into the detection and remediation process is truly impressive,” he said.
“At the same time, attackers have shifted to client side vulnerabilities, a change that we only partly assimilated. We are good in addressing the browser vulnerabilities, but generally lag behind in other areas that will be in focus this month such as Adobe Reader and Java,” he added.