WSUS Allows Attacker Distribute Infected Windows Updates

Companies and organizations that their Windows Server Update Services (WSUS) have not configured securely give attackers the ability to provide the entire corporate network from infected Windows updates.WSUS acts as a proxy for Windows Update. Companies can deploy effectively via WSUS Windows updates within their local network.

Instead of all company computers to connect to Microsoft servers to download updates, this is done once by WSUS. The WSUS server is installed in the corporate network and all connected business computers then will their Windows updates downloaded from the WSUS server. By default, WSUS, however not enabled to use HTTPS. An attacker who already has access to the corporate network can use to take then other company computers.

That researchers Paul Stone and Alex Chapman at the Black Hat conference demonstrated in Las Vegas ( pdf ). To prevent attacks via Windows Updates Windows only accepts updates that are signed by Microsoft. The researchers showed that an attacker Microsoft signed files can reuse to inject malicious updates, which are then to execute arbitrary commands on the attacked computers.

The attack, according to Stone and Chapman easy to avoid, namely setting up SSL. Most companies would also do this, so let them versus SC Magazine know. Companies, however, have not brought the risk that a system at one time the entire corporate network can compromise, the researchers said. In addition to enabling SSL by companies that use WSUS, Microsoft may also screwing security. The software giant would namely to use a separate certificate for the signings of Windows updates.

Microsoft Patches 59 Vulnerabilities, Of Which 7 Zero Days

Microsoft Patch Tuesday during the July 59 vulnerabilities in Windows, Internet Explorer, Office and SQL Server patched, 7 of zero days. It is in this case for vulnerabilities that were already known or were attacked before the relevant Microsoft security update was available.

Three of the zero-day vulnerabilities in Internet Explorer, Office and Windows were actively attacked, Microsoft said. Two of these vulnerabilities in IE and Windows, were coming from the Italian company hacked Hacking Team. This means that Hacking Team possessed far as is known about five zero-day vulnerabilities. In addition to IE and Windows, the company had also provided with three unknown vulnerabilities in Adobe Flash Player. The remaining four zero-day vulnerabilities that Microsoft patched this month found in IE and were already made ​​public, but according to the software giant does not actively attacked.

Updates

In total there are 14 security updates. Thus it belongs patch round both the number patches as corrected vulnerabilities into one of the toughest rounds patch from Microsoft ever. Four updates, MS15-065 , MS15-066 , MS15-067 and MS15-068 , have the highest priority and are labeled by Microsoft as critical. Through these vulnerabilities, an attacker can take over the underlying system. These include a vulnerability in the Remote Desktop Protocol (RDP). RDP is not enabled by default, but if that is the case an attacker by sending a few packets take over the system.

Three other updates are not labeled as critical, but let an attacker or run arbitrary code on a computer. It is MS15-058 for SQL Server MS15-069 for Windows and MS15-070 for Office. Microsoft regards this update as "important" because an attacker needs to do more effort before code execution is possible. The other security bulletins this month fix vulnerabilities that an attacker can increase his privileges on the computer. These include to the zero-day flaw in Windows which was discovered by Hacking Team. In these vulnerabilities, an attacker must already have access to the system before use can be made.

The updates can be downloaded via Windows Update and will be automatically installed on most computers. An overview of all bulletins on this page to find.

Microsoft Patches 45 Vulnerabilities, Including Stuxnet And FREAK

Microsoft has during Patch Tuesday of March 14 released updates, which together 45 vulnerabilities in Windows, Office, Exchange and Internet Explorer fix, including the Stuxnet leak from 2010 and the recently discovered FREAK leak. Especially re-patching the Stuxnet leak creates experts in amazement.Through the vulnerability knew the Stuxnet worm and the Fanny-espionage worm to spread.

Only connect a USB stick that made ​​the leak abuse was sufficient to infect Windows, even stood Autorun and Autoplay disabled. It was in fact a whole new way to attack Windows computers. In 2010, Microsoft came up with an update for the leak, but this patch showed the vulnerable code is not corrected, allowing Windows computers all the time were vulnerable, so warn researchers from HP.

There is also an update to the " FREAK-leak "in SSL / TLS appeared. Through the vulnerability, an attacker who is between a target and the Internet is in some cases the encryption of the encrypted connection to downgrade to a weak encryption to crack then that and to see the encrypted traffic.

Other vulnerabilities

In addition to the update for the Stuxnet leak four other updates are labeled as critical. Through these updates fix vulnerabilities that an attacker in the worst case can take over the entire system. It comes to vulnerabilities in Internet Explorer, the VBScript Scripting Engine in Windows, Adobe Font Driver and Office. In the case of one of the IE-leakage was the vulnerability already publicly known before the patch appeared. Through other vulnerabilities that Microsoft patched attackers could increase their rights to systems retrieve information, cause a denial of service and bypass security measures.Can update via Windows Update .

Microsoft Patches 56 Vulnerabilities In Windows, IE and Office

During the Patch Tuesday in February, Microsoft has nine updates that released a total of 56 vulnerabilities in Windows, Office, Internet Explorer and Microsoft Server software fix. Three of the patches as critical, while the remaining six were labeled as important.

The three critical updates for Windows Kernel Mode Driver, Windows Group Policy and IE and give an attacker the ability to take the operating system in the worst case completely. Most leaks were this patch Tuesday patched in Internet Explorer.Security Bulletin MS15-009 namely fixes 41 vulnerabilities. Of these leaks, there was one already made ​​public before the update appeared. However, Microsoft has not observed attacks who abuse the leak.

This is different in the case of another leak that resolves MS15-009. This is a vulnerability to bypass ASLR protection of IP.An attacker would have to combine this vulnerability with another leak to perform an attack. In the case of Office are three vulnerabilities in the past. These vulnerabilities allowed an attacker to execute arbitrary code on the computer when a malicious Office file was opened. All nine security updates using Windows Update to download.