Microsoft is out with its monthly Patch Tuesday update, this time issuing 13 security bulletins, four of which are rated critical. Overall, the update patches 47 different vulnerabilities across the 13 advisories, spanning multiple Microsoft products, including Windows, Office, SharePoint and Internet Explorer.
Among the critical advisories this month is MS13-068, which details a vulnerability in Microsoft Outlook that could allow for remote code execution.
“A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially crafted S/MIME email messages,” Microsoft’s bulletin states. “An attacker who successfully exploited this vulnerability could take complete control of an affected system.”
S/MIME (Secure/Multipurpose Internet Mail Extensions) is a widely used standard approach for the delivery of secure email messages. In a rare move, Microsoft has also written a detailed blog post explaining what the MS13-068 vulnerability is all about. The issue is a double-free memory corruption vulnerability that could potentially enable an attacker to take control of a user’s PC simply by viewing a message in the Outlook preview pane. A double-free error is a particularly dangerous flaw in that a given memory segment is freed by a program twice, which could enable corruption.
Though Microsoft has given the vulnerability a critical rating, it does not expect the vulnerability to be easily exploited.
“In fact, we’re not certain that the issue is exploitable at all, but out of an abundance of caution and because attack technology improves over time, we are issuing the security update today,” Microsoft Security Response Center engineer Jinwook Shin wrote.
Despite Microsoft’s downplaying the critical bug in Outlook, users should still pay close attention to this bulletin, said Andrew Storms, senior director of DevOps for cloud security specialist CloudPassage.
“Unlike other Outlook vulnerabilities that require the user to open an email or an attachment, simply having the default configuration or preview pane enabled can launch a weaponized email message,” Storms said. “The good news is that a workable mitigation technique will be to disable the preview pane.”
The MS13-068 vulnerability is a “smart attack” as it uses a security feature (email signing) to exploit the target, said Wolfgang Kandek, CTO at security specialist Qualys. More attacks in a similar area in the future are likely, he said.
Office
Remote code execution vulnerabilities are also the focus of at least three separate advisories that Microsoft is issuing for its Office suite.
The MS13-072 bulletin details 13 privately reported vulnerabilities in Office.
“The security update addresses the vulnerabilities by correcting the way that Microsoft Office parses specially crafted files and by correcting the manner in which the XML parser used by Word resolves external entities within a specially crafted file,” Microsoft stated in its bulletin.
Additionally, MS13-073 details three further vulnerabilities that affect Microsoft Excel, which is part of the Office suite. The MS13-074 bulletin details three flaws that are specific to Microsoft Access.
Internet Explorer
Once again, Microsoft is also patching its Internet Explorer (IE) browser in a Patch Tuesday update. The MS13-069 bulletin details 10 privately reported security issues with IE.
With the vulnerabilities, an attacker could use a malicious Web page to gain control over the targeted machine, Qualys’ Kadek said. Microsoft has been aggressively patching IE in 2013. In the August Patch Tuesday update, IE was patched for 11 issues, while the July Patch Tuesday update addressed 17 flaws in IE.
Microsoft’s regular monthly updates for IE are a good move, Kandek said. “There is a steady stream of research ongoing in the browser area, and IE continues to be a top target,” he said.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.