14 DAY TRIAL // Not only is Windows 7 RTM not affected by the Server Message Block (SMB) Protocol 2.0 critical zero-day vulnerability, but the latest iteration of the Windows client is also safe from a range of vulnerabilities impacting previous Windows releases. Microsoft released five security bulletins on September 8, 2009, addressing a total of eight vulnerabilities in Windows and Windows Server. However, the lucky few that are already running the gold versions of Windows 7 or Windows Server 2008 R2 don’t have to apply a single patch. The same is in no way valid for users of older versions of Windows, who are advised to download and deploy the security updates as soon as possible.
According to Jerry Bryant, senior security program manager for Microsoft, the five bulletins, which are all rated Critical, are designed to bulletproof Windows machines against two types of threats, namely browser-based and network-based attacks. In this first case, the malicious code is hosted on malformed websites, while in the latter, exploits can come over the network attempting Remote Code Execution (RCE) or Denial-of-Service (DoS) attacks.
Windows Vista RTM/SP1/SP2 contains vulnerabilities patched by no less than four of the total five patch packages released by Microsoft. In this regard, customers need to patch their Vista copies for vulnerabilities in the Wireless LAN AutoConfig Service, in Windows TCP/IP, in Windows Media Format and in the JScript Scripting Engine. As far as Windows XP SP2/SP3 is concerned, the security updates plug holes in the DHTML Editing Component ActiveX Control, the JScript Scripting Engine, in Windows Media Format, and in the Wireless LAN AutoConfig Service.
“The company recommends that all customers sign up for Microsoft Update and enable the Automatic Update functionality,” Bryant advised. “This will enable customers to download all available updates and help to make their systems more secure.”
Bryant enumerated all the security bulletins released by Microsoft on September 8th. The patches have been released to Windows Update and are currently available for download:
• MS09-045 (Maximum severity of Critical): This update resolves one privately reported vulnerability in Windows, which could allow remote code execution if a user opened a specially crafted file or visited a specially crafted Web site and invoked a malformed script. This update received a 1 rating from Microsoft’s Exploitability Index.
• MS09-046 (Maximum severity of Critical): This update resolves one privately reported vulnerability in Windows, which could allow an attacker to exploit it by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. This update received a 2 rating from Microsoft’s Exploitability Index.
• MS09-047 (Maximum severity of Critical): This update resolves two privately reported vulnerabilities in Windows, which could allow remote code execution if a user opened a specially crafted media file. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. This update received a 1 rating from Microsoft’s Exploitability Index.
• MS09-048 (Maximum severity of Critical): This update resolves three privately reported vulnerabilities in Windows, which could allow remote code execution if an attacker sent specially crafted TCP/IP packets over the network to a computer with a listening service. This update received a 2 rating from Microsoft’s Exploitability Index.
• MS09-049 (Maximum severity of Critical): This update resolves one privately reported vulnerability in Windows, which could allow remote code execution if a client or server with a wireless network interface enabled receives specially crafted wireless frames. This update received a 2 rating from Microsoft’s Exploitability Index.