Microsoft December 2005 Security updates
Sans has the tip that information on the critical Windows updates expected tomorrow from Microsoft has started to be released.
MS 05-54: Cumulative Security Update for Internet Explorer
This will hopefully patch the javascript issues…
MS 05-55: Vulnerability in Windows Kernel Could Allow Elevation of Privilege.
More later in the day I’m sure.
The Kernel Vulnerability described here is an escalation of privilige vulnerability (local only?)
The Internet Explorer update does appear to address the remote code execution (recent javascript 0-day) vulnerability. There are caveats with this update. There may be problems with the update. They will be described in this knowledge base article http://support.microsoft.com/kb/905915 (which isn’t yet up at 1:28PM EST 12/13/05).
Here’s some info from SANs… kernel vulnerability:
A vulnerability in the Asynchronous Procedure Call queue allows local users to escalate their privileges. A regular user (who has to be logged in first) could use this vulnerability to gain Administrator privileges.
Microsoft rates this vulnerability as “Important” as there is no direct remote vector to exploit this issue. However, coupled with an Internet Explorer vulnerability or similar issues, this could be used to gain Administrator privileges even if a user runs Internet Explorer as a less privileged user.
Note that remote exploit may be possible if user credentials are known.
Explorer cumulitive update:
File Download Dialog Box Manipulation Vulnerability – CAN-2005-2829
HTTPS Proxy Vulnerability- CAN-2005-2830:
COM Object Instantiation Memory Corruption Vulnerability – CAN-2005-2831:
Mismatched Document Object Model Objects Memory Corruption Vulnerability – CAN-2005-1790:
This last item addresses the javascript 0-day exploit that was exploited late November.
–update 2:18 EST–
The security fix has mentioned the fixes and details the history of the zero-day exploit. It’s also worth mentioning – he points out that this cumulitive fix also removes a component left behind by Sony’s uninstaller for the XCP software. I need to re-read….
Popularity: 1% [?]
Related Posts - Microsoft October 2006 patch Tuesday The first thing I should mention is that this months update from Microsoft is the last for XP SP1 users should plan a migration path to SP2 to keep getting updates to XP. Multiple vulnerabilities this month have been patched in Office There are 4 advisories, but a total of......
- Massive Windows Update Tuesday Microsoft had a mammoth patch Tuesday this month with 28 bug fixes (23 critical). (Computerworld article linked above. This is one of the largest update releases in five years (!) Those fixes were wrapped up in 8 updates for Internet Exporer, Office, Sharepoint, Windows media player and visual studio and......
- Microsoft's speed to get security patches out Brian Krebs at the Security Fix has done an interesting study related to how long it takes Microsoft to release a security fix for a problem, starting from the time they are notified of the security vulnerability. For the most part, 134.5 days has been the window between notification and......
Related Websites - Internet Marketing Flaw (function() {var s = document.createElement('SCRIPT'), s1 = document.getElementsByTagName('SCRIPT')[0];s.type = 'text/javascript';s.async = true;s.src = 'http://widgets.digg.com/buttons.js';s1.parentNode.insertBefore(s, s1);})(); 5Digg Digg (function() {var s = document.createElement(‘SCRIPT’), s1 = document.getElementsByTagName(‘SCRIPT’)[0];s.type = ‘text/javascript’;s.async = true;s.src = ‘http://widgets.digg.com/buttons.js’;s1.parentNode.insertBefore(s, s1);})(); 5 Digg Digg (function() {var s = document.createElement(‘SCRIPT’), s1 = document.getElementsByTagName(‘SCRIPT’)[0];s.type = ‘text/javascript’;s.async = true;s.src = ‘http://widgets.digg.com/buttons.js’;s1.parentNode.insertBefore(s, s1);})();......
- What is Patch Tuesday? Excellent explanation of Patch Tuesday by TMI Engineering Patch Tuesday is the second Tuesday of each month, the day on which Microsoft releases security patches. Starting with Windows 98, Microsoft included a "Windows Update" system, that would check for patches to Windows and its components which Microsoft would release intermittently. With......
- Spyware: The New Annoying Threat A friend called me one day, frustrated out of his mind that his computer was acting very strange. When he opened his Internet Explorer, it sent him to a strange site and pop-up windows kept covering his screen. He even complained about the performance of his Intel Pentium 4 computer......
Similar Posts
- Exploit for Unpatched Internet Explorer vulnerability
- Linux Local kernel vulnerability
- 3 Critical Microsoft Updates, 1 Important, 1 Moderate and 1 re-released
- Microsoft Releasing out of Cycle Patch for Internet Explorer Exploit
- DoS Exploit for MS-053