Patch Analysis for February 2009

An interesting month for MS security bulletins.  I'd say the most important one is the workstation vulnerability in IE 7 (MS09-002).  The exploit details are not yet public but Microsoft's new exploitability index rates it as "1 - Consistent exploit code likely".  This new exploitablilty index is a useful way for Microsoft to help us assess in assigning priority to patches and deciding how much time we have to testing before getting the patch out there to vulnerable systems.  You can read more about the index by clicking here.  The other workstation patch affects Visio but I think you can do your normal testing before rolling it out.
The Exchange vulnerabilities are definitely holes you want to patch on your Exchange servers as soon possible.  The exploit details are not yet public and the exploitability index indicates this one is a bit more difficult for the bad guys to exploit.  Given that and the fact that Exchange server availability is so critical for most of us I think you should do some testing before rolling it out if you have an Exchange test environment.
Finally there is a hole in many versions of SQL Server including the Windows Internal Database in later versions of Windows Server.  Did you know that Windows Server comes with an embedded version of SQL Server?  Yep.  Current versions of Microsoft's bulletins and summary are inconsistent about whether exploit details are public.  You may be able to use the workaround on this one.

BulletinExploit Types
/Technologies Affected
System Types AffectedExploit
details public?
/ Being exploited?
MS severity ratingProducts AffectedNotesRandy's recommendation

Arbitrary code

/ Visio
No/NoNoImportant Visio 2003
Visio 2002
Visio 2007
 Patch after testing

Arbitrary code

/ Exchange
Exchange Servers
No/NoNoCritical Exchange 2007
Exchange 2003
 Patch after accerlated testing

Arbitrary code

Terminal Servers
SQL Server Systems
Yes/NoYesImportant Win2000
SQL Server 2000
SQL Server 2005
Server 2003
Server 2000
Datacenter Server 2000
Advance Server 2000
Datacenter Server 2008
Enterprise Server 2008
 Patch after testing

Arbitrary code

/ Internet Explorer 7
No/NoNoCritical XP
 Patch ASAP

Receive Randy's same-day, independent analysis each Patch Tuesday

We will not share your address. Unsubscribe anytime. 

"Thank you. I am very glad I subscribed to this newsletter.  Relevant content clearly and concisely. Finally!!!"

- John K.

"I really like the Fast Facts on this Month's Microsoft Security Bulletins. Do you keep old copies? If yes, please let me know how I can access them?"

-Susan D.

"Thanks, Randy. Your regular updates have streamlined my monthly patching. Much appreciated,"

-  Steve T.

"Really appreciate your patch observor. In the corporate IT world, anything we can get our hands on that speeds the process of analyzing threats and how they may or may not apply to our environments is a God-send. Thanks so much for your efforts."

- Tess G.

"Many thanks for this Randy"

- Roger G.

"The chart is a REAAALLY good idea :)"

- Phil J.

"I like the table. Your insight is very valuable. "

Tom C.

"I liked your high level overview of patches in the table. There are so many sources of patch information which can be very specific or surrounded by other stuff that it’s refreshing to get everything summarised like this. The “Randy’s Recommendation” comment is useful starting point too. Please keep up the good work."

- David A.

"Your Patch Observer is a very good tool in making the decision whether to patch or not to patch. And also to patch asap or to wait a while before patching. Also I do think the use of the table is realy improving the readability of the provided information."

- Gerard T.


Additional Resources