Patch Tuesday Analysis for February 2009

An interesting month for MS security bulletins.  I'd say the most important one is the workstation vulnerability in IE 7 (MS09-002).  The exploit details are not yet public but Microsoft's new exploitability index rates it as "1 - Consistent exploit code likely".  This new exploitablilty index is a useful way for Microsoft to help us assess in assigning priority to patches and deciding how much time we have to testing before getting the patch out there to vulnerable systems.  You can read more about the index by clicking here.  The other workstation patch affects Visio but I think you can do your normal testing before rolling it out.
 
The Exchange vulnerabilities are definitely holes you want to patch on your Exchange servers as soon possible.  The exploit details are not yet public and the exploitability index indicates this one is a bit more difficult for the bad guys to exploit.  Given that and the fact that Exchange server availability is so critical for most of us I think you should do some testing before rolling it out if you have an Exchange test environment.
 
Finally there is a hole in many versions of SQL Server including the Windows Internal Database in later versions of Windows Server.  Did you know that Windows Server comes with an embedded version of SQL Server?  Yep.  Current versions of Microsoft's bulletins and summary are inconsistent about whether exploit details are public.  You may be able to use the workaround on this one.

BulletinExploit Types
/Technologies Affected
System Types AffectedExploit
details public?
/ Being exploited?
Comprehensive,
practical
workaround
available?
MS severity ratingProducts AffectedNotesRandy's recommendation
MS09-005

957634
Arbitrary code

/ Visio
Workstations
No/NoNoImportant Visio 2003
Visio 2002
Visio 2007
 Patch after testing
MS09-003

959239
Arbitrary code

/ Exchange
Exchange Servers
No/NoNoCritical Exchange 2007
Exchange 2003
 Patch after accerlated testing
MS09-004

959420
Arbitrary code

/ SQL
Workstations
Terminal Servers
Servers
SQL Server Systems
Yes/NoYesImportant Win2000
SQL Server 2000
SQL Server 2005
Server 2003
Server 2000
Datacenter Server 2000
Advance Server 2000
Datacenter Server 2008
Enterprise Server 2008
 Patch after testing
MS09-002

961260
Arbitrary code

/ Internet Explorer 7
Workstations
No/NoNoCritical XP
Win2003
Win2008
 Patch ASAP

Receive Randy's same-day, independent analysis each Patch Tuesday

Email:
We will not share your address. Unsubscribe anytime. 

"Thank you. I am very glad I subscribed to this newsletter.  Relevant content clearly and concisely. Finally!!!"

- John K.

"I really like the Fast Facts on this Month's Microsoft Security Bulletins. Do you keep old copies? If yes, please let me know how I can access them?"

-Susan D.

"Thanks, Randy. Your regular updates have streamlined my monthly patching. Much appreciated,"

-  Steve T.

"Really appreciate your patch observor. In the corporate IT world, anything we can get our hands on that speeds the process of analyzing threats and how they may or may not apply to our environments is a God-send. Thanks so much for your efforts."

- Tess G.

"Many thanks for this Randy"

- Roger G.

"The chart is a REAAALLY good idea :)"

- Phil J.

"I like the table. Your insight is very valuable. "

Tom C.

"I liked your high level overview of patches in the table. There are so many sources of patch information which can be very specific or surrounded by other stuff that it’s refreshing to get everything summarised like this. The “Randy’s Recommendation” comment is useful starting point too. Please keep up the good work."

- David A.

"Your Patch Tuesday Observer is a very good tool in making the decision whether to patch or not to patch. And also to patch asap or to wait a while before patching. Also I do think the use of the table is realy improving the readability of the provided information."

- Gerard T.