March Microsoft IT Security Updates

On Tuesday, Microsoft released their security bulletin for the month of March. This marks the second month in a row that Microsoft has needed a cumulative security update for Internet Explorer, again patching remote code execution vulnerabilities within the browser. Of the seven updates, four are considered critical, the others rated important.

The update for Internet Explorer patches nine vulnerabilities, one of which was publicly disclosed, and can be exploited in the event that a user views a specially crafted web-page using IE. This is rated critical for Internet Explorer 6-10. It will require a restart.

There were also remote code execution vulnerabilities found within Microsoft Silverlight and all supported versions of Microsoft Visio Viewer 2010. Both of these vulnerabilities at their worst could allow the attacker to gain the same rights as the user.

Last of the critical updates addresses four vulnerabilities found in Microsoft SharePoint and SharePoint Foundation. In the event that a user clicks on a specially crafted URL and goes to a targeted SharePoint site, the attacker has the potential to successfully execute an elevation of privilege exploit. Microsoft has resolved these issues by making changes to the way Microsoft SharePoint server validates URLs and user input.

The important updates include two vulnerabilities that would allow information disclosure in Microsoft Office for Mac, as well as OneNote. Lastly, there’s a kernel-mode driver vulnerability that would allow an elevation of privilege on all supported releases of Microsoft windows, in the event that the attacker is able to get physical access to the system.

Again, one of the biggest and best practices to lower the risk to your company being affected by similar issues would be to only give users as many rights within a system as absolutely necessary. Keeping users at a level of need-to-know means that if a an attacker does end up successfully allowing a remote code execution exploit, their access is still limited. As Thu wrote in an earlier blog, people are the weakest link in security, and limiting access is a good way to address that, along with security training and policies.