Microsoft releases November security bulletin
John McCormick
Published: 16 Nov 2005 17:00 GMT
Redmond stuck to its schedule this month and released its security update on the expected date. After an embarrassment of riches in October, when the software giant released nine security bulletins, Microsoft scaled back in November and released just one. However, the bulletin addresses several vulnerabilities, two of which are critical.
Details
Microsoft's security department kept to its November schedule and
released one security bulletin for the regularly scheduled 8 November
deadline. Microsoft Security Bulletin MS05-053,
"Vulnerabilities in Graphics Rendering Engine Could Allow Code
Execution", addresses some new individual vulnerabilities as well as
replaces both MS03-045 and MS05-002 for Windows XP Service Pack1 only.
MS05-053 addresses the following vulnerabilities:
Graphics Rendering Engine vulnerability
This is a remote code execution threat caused by a buffer overrun in
the Windows Metafile and Enhanced Metafile image rendering engine (CAN-2005-2123).
As of 14 November, there have been no reports of exploits in the wild.
Researchers had disclosed none of these vulnerabilities publicly prior
to the release of the update.
Windows Metafile vulnerability
This is also a remote code execution threat caused by an unchecked buffer in the Windows Metafile image rendering engine (CAN-2005-2124).
As of 14 November, there have been no reports of exploits in the wild.
Researchers had disclosed none of these vulnerabilities publicly prior
to the release of the update.
Enhanced Metafile vulnerability
This is a denial of service threat with a maximum severity rating of moderate (CAN-2005-0803).
The culprit is an unchecked buffer in the Enhanced Metafile image
rendering engine. While proof of concept code has appeared on the
Internet, Microsoft reports that it hasn't received any notification of
actual attacks based on this vulnerability.
Microsoft Baseline Security Analyzer (MBSA) 1.2.1 and MBSA 2.0 will indicate if this update is necessary. In addition, Systems Management Server (SMS) will also detect whether the update is required and can help deploy this update.
Applicability
The threats generally affect Windows 2000 and later versions, including the 64-bit and Itanium editions.
The Graphics Rendering Engine vulnerability affects the following:
- Windows 2000 SP4
- All versions of Windows XP
- All versions of Windows Server 2003
The Windows Metafile vulnerability and the Enhanced Metafile vulnerability affect the following:
- Windows 2000 SP4
- Windows XP SP1 (but not Windows XP SP2)
- Windows Server 2003 (but not Windows Server 2003 SP1)
Risk level
Microsoft rates the Graphics Rendering Engine vulnerability as critical
for all affected platforms. The Windows Metafile vulnerability is a
critical threat for Windows 2000 SP4, Windows XP SP1 and Windows Server
2003; however, it is not a threat for Windows XP SP2 and Windows Server
2003 SP1.
The Enhanced Metafile vulnerability is only a moderate threat for Windows 2000 SP4, Windows XP SP1, and Windows Server 2003. This vulnerability poses no threat to Windows XP SP2 or Windows Server 2003 SP1. The severity ratings are the same for comparable 64-bit and Itanium-based versions.
Mitigating factors
Again, fully updated Windows XP and Windows Server 2003 operating
systems are not vulnerable to two of the three threats included in this
security bulletin. In addition, best practices such as not randomly
visiting strange Web sites and using email only in text mode can
eliminate the threat from the critical Graphics Rendering Engine
vulnerability. However, these best practices don't protect you from an
embedded image in an Office document, but you can mitigate that threat
by not opening documents from untrusted sources.
Fix
Install the update. According to Microsoft, fix the message length
verification so it isn't as likely to cause other problems as more
major patches sometimes do.
As a workaround for the most serious threat, the Graphics Rendering engine vulnerability, avoid untrusted Web sites that may contain malicious graphics files and open all emails in text mode.
Final word
There's certain to be the usual flurry of complaints about Microsoft
concerning this security bulletin, but it's only fair to point out that
anyone following best practices and enforcing those practices among
the users they support would probably have little exposure to these
threats. It's a bit like having your identity stolen because you fell
for a phishing scheme you mostly have yourself to blame even though
it makes you feel better to blame the vendor.
Although this patch is less likely to have unintended consequences than some of the major patches, keep in mind that any alteration to your system software has the potential to cause a problem with some poorly written application. Therefore, whenever possible, fully test any patch before installing it on a mission-critical system.
Did you find this article useful?
54 out of 127 people found this useful
- Share this article:
Full Talkback thread
1 comment
