Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: InfoSec Handlers Diary Blog - August 2008 Black Tuesday Overview InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

August 2008 Black Tuesday Overview

Published: 2008-08-12
Last Updated: 2008-08-13 17:26:02 UTC
by Stephen Hall (Version: 1)
1 comment(s)

Overview of the August 2008 Microsoft patches and their status.

# Affected Contra Indications Known Exploits Microsoft rating ISC rating(*)
clients servers
MS08-041 Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution
Access, Snapshot Viewer

CVE-2008-2463

KB 955617

Known expoit code being actively exploited. 

This is a workaround by implementing a kill bit.

Critical Critical Important
MS08-042 Vulnerability in Microsoft Word Could Allow Remote Code Execution
Word

CVE-2008-2244
KB 955048

Known expoit code being actively exploited.

Important Critical Important
MS08-043

Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution

Excel
CVE-2008-3003

CVE-2008-3004

CVE-2008-3005

CVE-2008-3006

KB 954066 No publicly known exploits Critical Critical Important
MS08-044

Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution

Office 2000, XP 2003, Works 8, Project

CVE-2008-3018
CVE-2008-3019
CVE-2008-3020

CVE-2008-3021

CVE-2008-3460

KB 924090
No publicly known exploits Critical Critical Important
MS08-045

Cumulative Security Update for Internet Explorer

Internet Explorer

CVE-2008-2254

CVE-2008-2255

CVE-2008-2256

CVE-2008-2257

CVE-2008-2258

CVE-2008-2259

KB 953838
Publically disclosed vulnerability but no known exploits. Critical PATCH NOW! PATCH NOW!
MS08-046

Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution

Windows 2000, XP, 2003


CVE-2008-2245

KB 952954
No publicly known exploits Critical Critical Important
MS08-047

Vulnerability in IPsec Policy Processing Could Allow Information Disclosure

Vista, 2008

CVE-2008-2246

KB 95373
No publicly known exploits Important Important Important
MS08-048

Security Update for Outlook Express and Windows Mail

Windows (OE, Mail)

CVE-2008-1448

KB 951066
No publicly known exploits Important Important Important
MS08-049

Vulnerability in Event System Could Allow Remote Code Execution

Windows

CVE-2008-1456

CVE-2008-1457

KB 950974
No publicly known exploits Important Important Important
MS08-050

Vulnerability in Windows Messenger Could Allow Information Disclosure

Windows Messenger

CVE-2008-0082

KB 955702
Publically disclosed vulnerability but no known exploits. Important Important Important
MS08-051

Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution

PowerPoint

CVE-2008-0120

CVE-2008-0121

CVE-2008-1455

KB 949785
No publicly known exploits Critical Critical Important
 
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
  • The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
  • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
  • Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
  • All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

 

1 comment(s)
Diary Archives