February 2012 Patch Tuesday: Critical IE, Windows kernel flaws fixed

By Stephanie Wright, Contributor

Microsoft repaired 23 vulnerabilities this month, fixing critical flaws in Internet Explorer, the Windows kernel and a significant error within the C runtime library which may be targeted by attackers using Windows Media Player.

The software giant released nine bulletins, including four “critical” bulletins as portion of its February 2012 Patch Tuesday. 

Bulletin MS12-010, which addresses four Internet Explorer vulnerabilities, was given a high priority by Microsoft and security-patching experts. Both most severe IE flaws could allow for remote code execution in Internet Explorer 7, 8 and 9.

“All of those issues were cooperatively disclosed to Microsoft, and we all know of no active exploitation inside the wild,” wrote Angela Gunn, senior response communications manager for Microsoft Trustworthy Computing within the MSRC blog. ”We recommend that buyers read during the bulletin information concerning MS12-010 and apply it once possible.”

The Internet Explorer patch must be made first priority because Web-based attacks are common and cybercriminals could easily arrange a malicious webpage to focus on victims or capture them in drive-by attacks, said Wolfgang Kandek, CTO of Redwood Shores, Calif.-based vulnerability management vendor Qualys Inc.

“The Internet Explorer [patch] is the foremost critical because there are such a lot of attacks against browsers ordinarilly. Anything that occurs at the browser has to be high at the list,” Kandek said.

Microsoft recommends customers who've not enabled automatic updating should manually install the patch immediately. Enterprises with automatic update enabled need not take action.

MS12-013, which addresses a buffer overflow vulnerability within the C runtime library, must also receive immediate attention, per Microsoft. The vulnerability can be exploited remotely in Windows 7 and Vista. It may only be accessed through one attack vector: Windows Media Player. An attacker must trick somebody into opening a malicious media file on a web site or in an email attachment.

Microsoft also addressed two critical kernel-level vulnerabilities in MS12-008 which may be targeted by attackers by tricking users into visiting a malicious website through an email or instant message. The flaw affects users of Windows XP, Windows Vista, Windows 7 and Windows Server 2003 and 2008. If successfully exploited, both errors could enable an attacker to run code in kernel-mode and install additional malware.

In addition, Microsoft issued MS12-016, which addresses two critical vulnerabilities in Microsoft .NET Framework and Silverlight, and may be considered high priority for users of these applications, whether running them on a Mac or PC. Corporations must be mindful that one of the most vulnerabilities affects work stations, and the alternative can affect servers, based on Qualys' Kandek.

An attacker who successfully exploits the coding errors can gain complete control of the machine or server and install additional malware, change or delete data and create new accounts with full user rights, in response to Microsoft. The patch addresses the difficulty by “correcting the style in which Microsoft .NET Framework and Microsoft Silverlight use unmanaged objects,” Microsoft said.

Other bulletins address three flaws in Microsoft SharePoint, a flaw within the Color Control Panel in Windows and five flaws in Microsoft Office which may be targeted using a malicious Visio file. The bulletins are rated “important,” but could potentially allow elevation of privilege and remote code execution.

Dig Deeper

• People that read this also read...