MS Patch: 13 tačaka, 26 ranjivosti

Bulletin

Most likely attack vector

Max Bulletin Severity

Max Exploit- ability Index

Likely first 30 days impact

Platform mitigations

MS10-013

(Quartz)

Victim opens malicious AVI or WAV file.

Critical

1

Likely to see working exploit in next 30 days.

MS10-007

(ShellExecute)

Attacker hosts a malicious webpage, lures victim to it.

Critical

1

Likely to see exploit code released resulting in binary on WebDAV share being executed.

For more detail, see this SRD blog post.

MS10-006

(SMB Client)

Locally logged-in attacker with low privilege runs a malicious executable to elevate to high privilege.

Critical

1

Likely to see working exploit code for local attacker escalation.

For more detail, see this SRD blog post.

MS10-008

(ActiveX kill-bits)

Attackers host a malicious webpage, lures victim to it

Critical

2

Likely to see working exploit for vulnerabilities in third party ActiveX controls.

MS10-012

(SMB Server)

Attacker sends network-based malicious connection to remote Windows machine via SMB.

Important

1

Likely to see working proof-of-concept in next 30 days for CVE-2010-0231 resulting in attacker luring remote victim user to open file on attacker server and initiating a connection back to machine where remote victim is logged on.

Less likely to see working exploit code for the authenticated code execution vulnerability (CVE-2010-0020) or unauthenticated denial-of-service vulnerabilities (CVE-2010-0021 and 0022)

For more detail, see this SRD blog post.

MS10-015

(Kernel)

Attacker already able to execute code as low-privileged user escalates privileges.

Important

1

Proof of concept code already widely available. No active attacks.

MS10-011

(CSRSS)

Attacker who logs onto console of system where victim later logs onto console of same system can potentially run code with victim’s identity.

Important

1

Likely to see proof-of-concept code published for this vulnerability. However, unlikely to see wide-spread exploitation due to extensive user interaction required.

MS10-009

(TCP/IP)

Attacker sends network-based attack against system on local subnet.

Critical

2

May see denial-of-service proof-of-concept code published leveraging CVE-2010-0239 or CVE-2010-0241. Attackers are less likely to discover real-world attack surface in next 30 days for CVE-2010-0240.

/GS effective mitigation for CVE’s:

CVE-2010-0239

CVE-2010-0240

CVE-2010-0241.

CVE-2010-0242 is denial of service only.

MS10-003

(Excel)

Attack sends malicious .xls file to victim who opens it with Office XP or lower. (Office 2003, 2007 not affected.)

Important

1

Likely to see working exploit file effective on Office XP in first 30 days.

Office 2003 and Office 2007 not affected.

MS10-004

(PowerPoint)

Attacks malicious .ppt file to victim who opens it with Powerpoint Viewer 2003.

Important

1

Likely to see working exploit file effective on PowerPoint Viewer 2003. However, PowerPoint Viewer 2003 was replaced online by PowerPoint Viewer 2007. Only victims who use PowerPoint Viewer 2003 from Office 2003 install disk would be vulnerable to the PowerPoint Viewer vulnerabilities.

Less likely to see working exploit for other PowerPoint vulnerabilities.

MS10-010

(Hyper-V)

Attacker running code on virtual machine crashes host OS.

Important

3

Unlikely to see working exploit code in next 30 days.

MS10-014

(Kerberos)

Attacker potentially able to cause denial of service via Kerberos traffic if victim server configured with trust relationship to MIT Kerberos realm.

Important

3

Unlikely to see public exploit code in next 30 days.

MS10-005

(GDI+)

Attacker sends malicious JPEG to victim. Victim saves JPG, launches mspaint, and then file->opens the malicious JPEG

Moderate

1

Likely to see exploit code developed. Unlikely to have broad impact as mspaint is not registered file association for JPEG.