Patch Tuesday Analysis for June 2007
This month we get an interesting mix of security patches from Microsoft. None of these are at the “the sky is falling!” level of severity and all of the patches are Workstation/Terminal Server focused; if you are a server only admin you can probably relax provided you don’t engage in end-user activities such as web browsing or working with documents or email while logged on at the server. I think you are prudent to conduct full testing before any deployment. Several of the patches might be altogether avoidable depending on your environment including MS07-034 (Windows Mail and Outlook Express) as well as MS07-032 (Windows Vista only patch). Exploit details are public for 2 of the bulletins but due to other mitigating factors noted in the chart below I’m not recommending accelerated testing.
| Bulletin | Exploit Types
/Technologies Affected | System Types Affected | Exploit
details public?
/ Being exploited? | Comprehensive,
practical
workaround
available? | MS severity rating | Products Affected | Notes | Randy's recommendation | MS07-030
927051 | Arbitrary code
/ Visio | Workstations
Terminal Servers
| No/No | No | Important | Office 2003
| None | Patch after testing unless exploit details become public, then patch ASAP or block Visio files at perimeter | MS07-034
929123 | Arbitrary code
/ Outlook Express and Windows Mail | Workstations
Terminal Servers
| Yes/No | Yes | Critical | XP
Vista
Server 2003
| 4 different vulnerabilities with varying severity depending on OS | Patch after testing or prevent users from using Windows Mail and Outlook Express | MS07-032
931213 | Information disclosure
/ Windows Vista | Workstations
| No/No | No | Moderate | Vista
| Mostly an issue for shared workstations or environments where end-users lack administrator authority on their workstations | Patch after testing if an issue for your environment | MS07-033
933566 | Arbitrary code
/ IE | Workstations
Terminal Servers
| Yes/No | No | Critical | Win2000
XP
Vista
Server 2003
| 6 different vulnerabilities Only one is public and risk is limited to spoofed web pages | Patch after testing | MS07-035
935839 | Arbitrary code
/ Windows | Workstations
Terminal Servers
| No/No | Yes | Critical | Win2000
XP
Server 2003
| None | Patch after testing unless exploit details become public, then patch ASAP | MS07-031
935840 | Arbitrary code
/ Windows | Workstations
Terminal Servers
| No/No | No | Critical | Win2000
XP
Server 2003
| Mostly likely even on XP to cause denial of service instead of arbitrary code execution | Patch after testing |
Receive Randy's same-day, independent analysis each Patch Tuesday
Email:
We will not share your address. Unsubscribe anytime.
|
"Thank you. I am very glad I subscribed to this newsletter.
Relevant content clearly and concisely. Finally!!!"
- John K.
"I really like the Fast Facts on this Month's Microsoft
Security Bulletins. Do you keep old copies? If yes, please let me know how I can
access them?"
-Susan D.
"Thanks, Randy. Your regular updates have streamlined my
monthly patching. Much appreciated,"
- Steve T.
"Really appreciate your patch observor. In the corporate
IT world, anything we can get our hands on that speeds the process of analyzing
threats and how they may or may not apply to our environments is a God-send.
Thanks so much for your efforts."
- Tess G.
"Many thanks for this Randy"
- Roger G.
"The chart is a REAAALLY good idea :)"
- Phil J.
"I like the table. Your insight is very valuable. "
Tom C.
"I liked your high level overview of patches in the
table. There are so many sources of patch information which can be very specific
or surrounded by other stuff that it’s refreshing to get everything summarised
like this. The “Randy’s Recommendation” comment is useful starting point too.
Please keep up the good work."
- David A.
"Your Patch Tuesday Observer is a very good tool in
making the decision whether to patch or not to patch. And also to patch asap or
to wait a while before patching. Also I do think the use of the table is realy
improving the readability of the provided information."
- Gerard T.
|