Microsoft December 2012 Black Tuesday Update

Overview of the December 2012 Microsoft patches and their status.

#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	ISC rating(*)
#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	clients	servers
MS12-077	Internet Explorer Cumulative Patch (Replaces MS12-063 MS12-071 )
MS12-077	Internet Explorer 9/10 CVE-2012-2545 CVE-2012-4781 CVE-2012-4782 CVE-2012-4787	KB 2761465	No.	Severity:Critical Exploitability: 1	Critical	Critical
MS12-078	Windows Kernel Mode Drivers Remote Execution (Replaces MS12-032 MS12-075 )
MS12-078	Kernel mode drivers CVE-2012-2556 CVE-2012-4786	KB 2783534	No.	Severity:Critical Exploitability: 1	Critical	Important
MS12-079	Microsoft Word RTF Data Remote Code Execution (Replaces MS12-064 )
MS12-079	Word CVE-2012-2539	KB 2780642	No.	Severity:Critical Exploitability: 1	Critical	N/A
MS12-080	Windows Exchange Server Remote Code Execution (Replaces MS12-058 )
MS12-080	Exchange Server CVE-2012-3214 CVE-2012-3217 CVE-2012-4791	KB 2784126	Yes.	Severity:Critical Exploitability: 1	N/A	Critical
MS12-081	Windows File Handling Remote Code Execution (Replaces MS07-035 MS11-063 )
MS12-081	Windows CVE-2012-4774	KB 2758857	No.	Severity:Critical Exploitability: 1	Critical	Critical
MS12-082	DirectPlay Remote Code Execution
MS12-082	DirectPlay CVE-2012-1537	KB 2770660	No.	Severity:Important Exploitability: 1	Critical	Important
MS12-083	IP-HTTPS Security Feature Bypass
MS12-083	Direct Access CVE-2012-2549	KB 2765809	No.	Severity:Important Exploitability: 1	Important	Important

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

------
Post suggestions or comments in the section below or send us any questions or comments in the contact form

--
John Bambenek
bambenek /at/ gmail.com
Bambenek Consulting

John

262 Posts
ISC Handler

Dec 11th 2012

Given that MS12-083 is for a DirectAccess CA issue and "What systems are primarily at risk from the vulnerability?
Servers are at risk from this vulnerability."
http://blogs.technet.com/b/srd/archive/2012/12/11/ms12-083-addressing-a-missing-certificate-revocation-check-in-ip-https.aspx
As per that blog post, it's the direct access server that can be tricked into allowing a client into the network that should be revoked. The vulnerability is thusly only on the server side, not a client vulnerability.

Yes if you use a Windows 2012 as a workstation you may be offered up this patch but unless you turn that workstation into a DA authentication server it will never be "vulnerable" to attack. I think your grid does a disservice to the risk rating on the "client side" of Server 2008 r2/Server 2012 as I read this.

Susan

34 Posts

- http://technet.microsoft.com/en-us/security/advisory/2749655
V2.0 (December 11, 2012): Added the KB2687627 and KB2687497 updates described in MS12-043, the KB2687501 and KB2687510 updates described in MS12-057, the KB2687508 update described in MS12-059, and the KB2726929 update described in MS12-060* to the list of available re-releases...
___
The following bulletins have undergone a major revision increment. See the appropriate bulletin for more details.
- http://technet.microsoft.com/security/bulletin/MS12-043
- http://technet.microsoft.com/security/bulletin/MS12-050
- http://technet.microsoft.com/security/bulletin/MS12-057
- http://technet.microsoft.com/security/bulletin/MS12-059
- http://technet.microsoft.com/security/bulletin/MS12-060
(Thanks to Susan Bradley...)
.

Jack

160 Posts

The chart indicates that MS12-080 has a known exploit but does not indicate which CVE is impacted. I tried searching and canâ€™t find the vulnerability that has the known exploit. Does anyone know which vulnerability it is (Oracle Outside In or RSS Feed)?

Thanks,

Thanks,

Jack
2 Posts

I'm having problem with KB2758857. All of the other patches work fine but that one is causing some programs to crash. (MS Money most notably - yes, I know it's been sunsetted)

I get a C++ runtime error with KB2758857 installed. Removing it gets rid of the problem.

Anyone else?

Jack
1 Posts

Known issues with this security updateâ€¢We are aware of issues related to OpenType Font (OTF) rendering in applications such as PowerPoint on affected versions of Windows that occur after this security update is applied. We are currently investigating these issues and will take appropriate action to address the known issues. "
Per http://support.microsoft.com/kb/2753842

Official statement by Microsoft showcasing they are aware of the issue and are investigating.

Susan

34 Posts

- https://technet.microsoft.com/en-us/security/bulletin/ms12-078
V2.0 (December 20, 2012): Re-released update KB2753842 to resolve an issue with OpenType fonts not properly rendering after the original update was installed. Customers who have successfully installed the original KB2753842 update need to install the rereleased update.
.

Jack

160 Posts