VERT Threat Alert: July 2015 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses 14 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-623 on Wednesday, July 15th.

MS15-058

The July Patch Tuesday starts off with June’s forgotten patch. This is the mystery bulletin that had it’s ID assigned but was held back last month. We now know that resolves three privately reported vulnerabilities in Microsoft SQL Server.

MS15-065

Up next, we have the latest Internet Explorer Cumulative update, which resolves 29 vulnerabilities. This includes CVE-2015-2398, CVE-2015-2421, CVE-2015-2413, and CVE-2015-2419 – all of which have been publicly disclosed. While none of these are currently being exploited, the knowledge that they are public should skyrocket the patch priority of this month’s update for most enterprises.

MS15-066

Just as we saw back in March, this month we have another update to VBScript where the update is spread across multiple bulletins. In this case, the update includes MS15-065, for versions of IE that ship with VBScript bundled, and MS15-066 for standalone versions of VBScript.

MS15-067

Up next, we have a vulnerability that only affects the latest Microsoft operating systems – Windows 7, Windows 8, and Windows Server 2012. This is one of the more critical issues this month since an unauthenticated attacker can target a listening service. If you have any affected boxes listening on the RDP port remotely, you may want to restrict or disable access until you can apply this update.

MS15-068

Another vulnerability that appears near the top of the list this month is MS15-068, which resolves two vulnerabilities in Hyper-V. In both cases, the Hyper-V vulnerabilities could allow an attacker with privileged access to a guest VM to break out of the VM and gain access to the host environment. Those running shared hosting on Microsoft Hyper-V should pay close attention to the deployment of this patch, as they will be the biggest targets until their systems are up-to-date.

MS15-069

DLL Loading issues were common for a while but now the updates seem to appear less frequently. This month the issues appear once again with two vulnerabilities, both of which involve loading malicious DLLs onto the system. The attack vector for these vulnerabilities has a huge impact in decreasing the risk compared to a number of other bulletins released this month.

MS15-070

A Microsoft patch drop isn’t complete without at least one Microsoft Office bulletin. This month’s quota is met by MS15-070, which resolves a large number of vulnerabilities affecting all supported versions of Microsoft Office as well as Excel Service on SharePoint Server 2007, 2010, and 2013.

MS15-071

There’s almost always a moment of fear when a vulnerability’s title includes “Netlogon” and it mentions the domain controller. Luckily, MS15-071 requires that an attacker already have credentials and access to a primary domain controller. That attacker could then create a fake backup domain controller. Since most domain controllers are locked down and not exposed to the Internet, the risk here should be limited to insider threats. That is not, however, a mitigation and enterprises should apply this update as soon as possible.

MS15-072

Up next, we have a vulnerability in Windows Graphics, another common sight on Patch Tuesday. This particular vulnerability occurs when processing bitmap conversions. Luckily, this does not appear to be a file format issue, which means that drive by attacks are not possible.

MS15-073

Much like Internet Explorer and Office, we can expect to see Win32k patched every single month. This was true again this month with 6 vulnerabilities in Win32k resolved in this update.

MS15-074

This update is an interesting elevation of privilege due to its complexity, which should limit its attractiveness to attackers. The attacker must gain access to a system, find a vulnerable .msi file, and load custom code that the .msi can find and execute.

MS15-075

Up next we have two vulnerabilities in Microsoft OLE that could be used to elevate privileges. According to Microsoft, attackers could chain exploits for these vulnerabilities with Internet Explorer vulnerabilities in order to gain higher privileges within IE.

MS15-076

The penultimate update this month fixes a vulnerability that allows for DCE/RPC connection reflection. Microsoft has stated that an attacker would need to be logged into a system and run a specially crafted application in order to exploit this vulnerability and elevate their privileges.

MS15-077

The final vulnerability this month should be at the top of everyone’s list, it’s the ATM Font Driver vulnerability that was released in the data dump from the recent Hacking Team Hack. Since exploit code is available, patching this should be a priority.

Additional Details

Adobe has released updates for Acrobat/Reader (APSB15-15), Shockwave (APSB15-17), and Flash (APSB15-18). Additionally, Oracle released their July CPU today including updates for Oracle Database, MySQL, Solaris, and Java. As always, VERT recommends that you apply all the patches as soon as possible but also that you fully vet patches (when possible) before applying them to production systems. Ease-of-Use (published exploits) to Risk Table