Gladiator Research and Security

Microsoft has announced five new patches for its monthly patch release cycle.  These patches fix multiple vulnerabilities in Microsoft Windows.   All five patches are rated Critical, allowing for remote code execution on vulnerable systems.   Gladiator recommends that users immediately apply all Critical patches to their systems. Detailed information for the patches can be found in Microsoft’s September Security Bulletin.  Summary information is included below:

• Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961) MS09-045 – This update fixes a remote code execution vulnerability in the JScript Engine.  This patch is rated Critical and should be applied as soon as possible.  This vulnerability is exploitable by visiting a malicious website or opening a malicious file.
• Vulnerability in Wireless LAN AutoConfig Service Could Allow Remote Code Execution (970710) MS09-049 – This update fixes a remote code execution vulnerability in the Wireless LAN AutoConfig Service.  Only systems with wireless cards are at risk from this vulnerability.  This patch is rated Critical, and should be applied as soon as possible.  This vulnerability is exploitable by sending a specially crafted wireless frame to vulnerable systems.
• Vulnerabilities in Windows Media Format Could Allow Remote Code Execution (973812) MS09-047 - This update fixes two remote code execution vulnerabilities in Windows Media Format.  This patch is rated Critical and should be applied as soon as possible.  This vulnerability is exploitable by opening specially crafted malicious media files.
• Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (967723) MS09-048 – This update fixes several remote code execution vulnerabilities in TCP/IP processing.  This patch is rated Critical and should be applied as soon as possible.  This vulnerability is exploitable by sending packets to listening services.
• Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844) MS09-046 – This update fixes a remote code execution vulnerability in the DHTML editing component ActiveX control.  ActiveX controls are used by websites viewed with Internet Explorer.  This patch is rated Critical and should be applied as soon as possible.  This vulnerability is exploitable by visiting a malicious website.

Gladiator recommends that users patch their systems quickly for all of the above vulnerabilities as exploit code is likely to be released in the near future.

Related Links:

• Microsoft Security Bulletin (http://www.microsoft.com/technet/security/bulletin/ms09-sep.mspx)
• SANS ISC Diary Entry (http://isc.sans.org/diary.html?storyid=7099)