IT Best Practices and Compliance Reporting Information

ANI Patch: How Do You Think Microsoft Handled It?

Last week, Microsoft released an out-of-band patch for a vulnerability affecting the animated cursor, also known as ANI.

The vulnerability was identified by Determina back in December, who, in turn notified Microsoft. For some, like eWeek's Joe Wilcox,  the four month timeframe to get out the patch is unreasonably long.

Wilcox compares the ANI vulnerability to a Windows metafile bug that created problems back in late December 2005/early January 2006. "Both flaws affect the Windows graphics subsystem—or GDI—and were exploited without patches being available." Both flaws also led to the release of several other fixes to the GDI. However, the patch for the WMF vulnerability was available in weeks, not days.

Microsoft provided there own explanation of the process involved in releasing the patch. Based on some initial feedback from SANS, the extra testing may pay off in ensuring the patch is effective and doesn't cause too many headaches. Larry Seltzer, another eWeek columnist, was one of many supporting Microsoft's decision to release the patch ahead of tomorrow's regular cycle, although he questioned the additional GDI patches being released with it. "By including it with this many other fixes they make it harder to test. Perhaps they should have left the rest of the update for next week," Seltzer said.

Mike Rothman, in one of his Daily Incite posts last week, didn't necessarily feel Microsoft handled the ANI vulnerability as well as they could, but found several signs of improvement in how Microsoft is handling issues in general. Like Mike, I found Rob Graham from Errata's explanation to be one of the more reasoned perspectives on the ANI vulnerability.

What did you think of Microsoft's effort? How do you think they could improve?

Microsoft Fixes Critical IE Flaw

As expected, one of the two patches that Microsoft released yesterday fixes the recent publicly disclosed vulnerability in how IE handles JavaScript “Window()” function calls.  On November 21^st an exploit was released targeting this flaw. 

The cumulative patch for IE, MS05-054, also includes previous fixes for the web browser.  The patch fixes a hole in IE’s COM (Component Object Model) that could allow remote code to run on some versions of IE, and fixes for moderately serious vulnerabilities in IE’s File Download Dialog box and HTTPS proxy.

It is highly suggested that you apply this patch as soon as possible as attacks have been reported on this flaw.

The other security bulletin, MS05-055, is rated as important and fixes a hole in the Windows core processing kernel on Windows 2000 machines running SP4.  This vulnerability could allow a user with few security privileges to take control of the Windows 2000 machine once successfully logged in.

2 Microsoft Patches Planned

It’s believed that one of the two planned Microsoft security bulletins for tomorrow will be rated as critical.  The critical patch is expected to fix an Internet Explorer flaw that is currently the target of multiple malicious exploits.  Microsoft had originally discussed issuing an out-of-cycle patch to thwart the IE attacks, but rigorous quality assurance testing delayed the release until the normal release date.

If you haven’t yet implemented an automated patch management solution, you should really start to think about it.  The time saving alone on your first deployment of Microsoft security updates will provide you with an almost total ROI.  This is valuable time you could spend on other projects.

If you have any stories about your patch management experiences, please feel free to share them here.

Still Not Patching In Time

In a research study by Qualys, they determined that companies are making patch management progress, but nearly 7 out of 10 business systems currently remain vulnerable to exploits and attacks. 

Their research also showed that on average companies are taking about 19 days to fix 50 percent of their internet facing systems and about 48 days to patch 50 percent of their internal systems.  Amazingly, this is a significant improvement over last year.  However, with attack times targeting known vulnerabilities shrinking, it’s mind boggling that companies are still not properly addressing patch management.

I understand that companies need to thoroughly test the patches before deploying them throughout their environments and that can delay deployment.  In fact, that should be a best a practice.  But, for those companies that are still manually deploying patches, there are a multitude of automated patch management solutions that can save you an unbelievable amount of time and resources in the deployment process.  And, provide in-depth reporting you can use to prove your patch status and compliance to your patch policies. 

For just dollars per system, there is no reason to not automate your patch management process.  Many of our customers realize an ROI in the first couple of times they use our Patch Manager.  Not only does it save them time and resources, they are able to reallocate those savings to other projects.  And, what happens if an exploit hits your company while you’re manually patching?  How much could that cost your business?

MS Patch Tuesday: November

Microsoft only released one patch this month, but it address three critical security vulnerabilities related to the way most of its operating systems process Windows Metafile images. 

MS05-053 - Vulnerability in the Windows graphics rendering engine could allow an attacker to take complete control of an affected system, including remote code execution

This update resolves several newly-discovered, privately reported and public vulnerabilities. Each vulnerability is documented in this bulletin in its own "Vulnerability Details" section of this bulletin. An attacker who successfully exploits the most severe of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

I recommend that you apply the update immediately.

Think Patch Management Is Only Microsoft’s Issue

Patch management issues go far beyond just Microsoft.  In fact, Oracle just announced a bundle of 23 patches addressing 88 vulnerabilities across its products.  33 of those vulnerabilities are in its database server software with many of them easy to exploit the confidentiality, integrity, and availability of information stored in the databases. 

Database break-ins are becoming more attractive to hackers because enterprises are putting more critical data into digital form and making that data more accessible.  While Oracle is recommending that these database patches be applied as quickly as possible, IT staffs will surely struggle with their change and configuration management as a result.

Simply applying this many patches will affect configuration settings on not only the Oracle database servers but systems upstream and downstream as well.  Managing all of these changes will be a major task for IT staff as they need to prepare for the troubleshooting of possible problems. 

With so many changes, trying to identify, track, and verify these changes manually will not be an efficient and cost-effective way of tackling this process.  IT staffs should consider automating the change and configuration management process to rapidly get control of the changes happening and have the information at hand to be properly prepared to minimize any potential downtime.

Patch Now or Face the Consequences

This past August, the Zotob worm infected major news organizations such as Cable News Network LP, LLLP; ABC Inc. Less than five days had elapsed between the Microsoft vulnerability disclosure and the first worm outbreaks.

In the first release of new Microsoft patches since August, the potential for a similar outbreak of worms appears likely.

Last Wednesday, Immunity Security began distributing a working exploit for the flaw to customers of its Canvas compliance-testing service. While the exploit is still being carefully kept under wraps, its very existence appears ominous to some.

The hole relates to Microsoft's bulletin MS05-051, which details a "remote, unauthenticated attack vector" on Windows 2000 systems, the same as that exploited by Zotob. The vulnerabilities are in Microsoft Distributed Transaction Coordinator (MSDTC) and COM+, and could allow an attacker to execute malicious code on Windows 2000 systems.

According to Bruce Hughes, senior antivirus researcher at TrendMicro (TMIC), virus writers are taking advantage of the delays typical of most corporate patch policies. "Most people don't patch for 30 to 60 days after a disclosure because they need to test it, and the virus writers know this.”

The consequences of not expediting patches for known vulnerabilities are becoming increasingly costly.  You can’t afford to patch your network manually or, even more alarmingly, allow patching decisions to rest with individual users. Don’t let another month pass without investing in an automated patch management solution that provides the speed and accuracy necessary to thwart the increasingly effective efforts of the virus writers.

Three Critical October MS Patches

Microsoft released nine new patches yesterday, but warned that you need to pay special attention to MS05-051.  This bulletin addresses four different Windows vulnerabilities that could create a remote unauthenticated attack vector on Windows 2000 systems.  It’s this same attack vector that led to the Zotob worm.  You should apply this patch as soon as you possibly can.  Here are the October bulletins from Microsoft:

Critical

MS05-050 - Vulnerability in DirectShow (DirectX) could allow remote code execution

MS05-051 - Vulnerabilities in MSDTC and COM+ could allow remote code execution

MS05-052 - Cumulative Security Update for Internet Explorer, including an update for a vulnerability that could allow an attacker to take complete control of an affected system

Important

MS05-046 - Vulnerability in the Client Service for NetWare could allow remote code execution

MS05-047 - Vulnerability in Plug and Play could allow remote code execution and Local Elevation of Privilege

MS05-048 - Vulnerability in the Microsoft Collaboration Data Objects could allow remote code execution

MS05-049 - Vulnerabilities in Windows shell could allow remote code execution

Moderate

MS05-044 - Vulnerability in the Windows FTP Client could allow file transfer location tampering

MS05-045 - Vulnerability in Network Connection Manager could allow an attacker to cause the component responsible for managing network and remote access connections to stop responding, causing denial of service. An attacker must have valid logon credentials to exploit this vulnerability.

Be Aware of Fake Patch

There’s a fake Windows security patch being circulated that is said to address the Plug and Play vulnerability that was recently exploited by Zotob worm and its variants.  The attached executable, MS05-039.EXE, is a Trojan horse program and should be deleted immediately.

Zero Day Exploitation Require Patch Vendors Act Promptly

After two weeks, the exploitations of the MS05-039 Plug and Play flaw may be waning, but have not ceased. thechannelinsider.com reports that there are now 19 worms that exploit the Plug and Play flaw.

However, the greatest cause for concern is the speed of the exploitations.  Johannes Ullrich, chief research officer at the SANS Internet Storm Center said it best in a recent Tech Web article. "The last week showed once more that there is no more patch window."

As the time shrinks between the discovery and exploitation of vulnerabilities, you need to employ new criteria in evaluating patch management solutions. While patching across a breadth of platforms, applications and devices is of value, it means little if they aren’t made available to you promptly. With exploitations down to days or even hours, you need to be assured that your vendor has dedicated the development and support resources to guarantee patches reach you promptly.

Rapidly providing releases is not enough, however. While the quality of Microsoft’s fixes has improved greatly with their monthly Patch Tuesday cycle, their fixes are not always perfect. Make sure your Patch Management Vendor has a process to test the patches before deploying them. While you still want to do your own testing, a vendor with strong quality controls may eliminate some headaches and valuable time in your patch deployment.

If you are currently evaluating patch management software, in addition to looking at the usual features and benefits, monitor the vendor websites on Patch Tuesday to see how quickly they deploy the patches. If you have a current Patch Management product and are regularly waiting more than 24 to 48 hours for patches to be made available, you should consider evaluating new options.