Patch Tuesday April 2012 - Patching Multiple Web Based Client Side and Spearphishing Exposures

This month's patch Tuesday fixes a small set of critical vulnerabilities in a variety of client side software and one "important" server side Forefront UAG data leakage/information disclosure issue. Six bulletins have been created to address eleven exploitable flaws. Three of the six bulletins are top priority and should be addressed ASAP. These are the MS12-023 bulletin, patching a set of five Internet Explorer vulnerabilities leading to remote code execution, and the MS12-027 bulletin, patching the MSCOMCTL ActiveX Control currently receiving some attention as a part of very limited targeted attacks. If they must prioritize deployment, administrators should start their work here. Most folks should have automatic updates enabled and will silently receive the patches, or they can simply navigate their start menu and manually begin the Windows update process.

RCE attacks abusing these six IE and ActiveX vulnerabilities would look like web browser redirections to malicious sites hosting web pages attacking Internet Explorer and emails carrying malicious attachments constructed to appear familiar to the targeted victim. These are currently significant vectors of attack for both consumer/home and corporate Microsoft product users.

Microsoft also is recommending that administrators prioritize the Authenticode flaw and rated it critical, which could be used as a part of targeted attacks. And ActiveX controls can be delivered leveraging this vulnerability, so some distribution vectors may become enhanced. But this flaw allows for additions and modifications to existing code that in turn won't invalidate the existing signature.

A vulnerability exists in the .Net framework, allowing for XBAP applications to be run from the Internet Zone with a prompt. But anytime a decision like that is left to a user, it seems that we have a 50/50 chance of successful exploitation. The remaining vulnerabilty in the Office converter is significant and may result in RCE, but is much less likely to be attacked.

Dangerous, but manageable.

Microsoft Update March 2012

Security Patch	March 2012 Security Release ISO Image This DVD5 ISO image file contains the security updates for Windows released on Windows Update on March 13, 2012.	FREE RELEASE DATE: 3/13/2012
Security Patch	Microsoft Expression Design 3 Security Update Expression Design 3 Security Update	FREE RELEASE DATE: 3/12/2012
Security Patch	Microsoft Expression Design 1 Security Patch Expression Design 1 Security Patch	FREE RELEASE DATE: 3/12/2012
Security Patch	Microsoft Expression Design 4 Security Update Expression Design 4 Security Update	FREE RELEASE DATE: 3/12/2012
Security Patch	Microsoft Expression Design 1 SP1 Security Patch Expression Design 1 SP1 Security Patch	FREE RELEASE DATE: 3/12/2012
Security Patch	Microsoft Expression Design 2 Security Update Expression Design 2 Security Update	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 x64 Edition (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 for x64-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista for x64-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 x64 Edition (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 x64 Edition (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 for x64-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 for x64-based Systems (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 x64 Edition (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows XP x64 Edition (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 x64 Edition (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 for Itanium-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 x64 Edition (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 x64 Edition (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 for x64-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 x64 Edition (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 x64 Edition (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 for x64-based Systems (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 for Itanium-based Systems (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista for x64-based Systems (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 x64 Edition (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 for Itanium-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 for x64-based Systems (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows 7 (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 x64 Edition (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows XP (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 x64 Edition (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 (KB2647170) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows XP x64 Edition (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 for Itanium-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012

Security Patch	Security Update for Windows 7 for x64-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2008 (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Server 2003 for Itanium-based Systems (KB2621440) A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Embedded Standard 7 for x64-based Systems (KB2667402) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected system to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows XP (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista (KB2665364) A security issue has been identified that could allow an unauthenticated remote attacker to cause the affected application to stop responding.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Windows Vista for x64-based Systems (KB2641653) A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Microsoft Visual Studio 2008 Service Pack 1 (KB2669970) A security issue has been identified leading to a vulnerability on your Windows-based system running Microsoft Visual Studio 2008 Service Pack 1.	FREE RELEASE DATE: 3/12/2012
Security Patch	Security Update for Microsoft Visual Studio 2010 (KB2644980) A security issue has been identified leading to a vulnerability on your Windows-based system running Microsoft Visual Studio 2010.	FREE RELEASE DATE: 3/12/2012