In March of 2014, we saw five updates from Microsoft, which brought the year to date patch count to 16. Here we are in March 2015 and this month’s Patch Tuesday release is nearly equal to the total count for the first quarter last year, and the year to date count is now just under double where we were at in 2014.

The Critical count for March is five bulletins affecting Internet Explorer, VBscript, Text Services, Adobe Font Drivers, and Office.

The additional nine Important updates affect Netlogon, Windows Task Scheduler, Windows Kernel, Remote Desktop Protocol, JPEG and PNG file formats, Kernel Mode Drivers, Schannel, and Exchange.

The 14 bulletins resolve 43 vulnerabilities. MS15-018 resolves one publicly disclosed vulnerability, which has been detected in target attacks (CVE-2015-0072) and CVE-2015-1625, which has also been publicly disclosed. MS15-031 resolves a vulnerability (CVE-2015-1637) in Schannel that facilitates exploitation of the publicly disclosed FREAK technique.

One nice addition to the Bulletin Summary page is a new column linking to known issues for that bulletin. Three of the bulletins link to KB articles with links to product specific pages so you can see product specific issues relating to the bulletin.  MS15-022 is a great example, although a little scary at the same time.  There are around 30 separate links to variations of Office, Sharepoint, Viewers, etc.

The first five bulletins are critical and should be rolled out as soon as possible.

  • This month’s IE Cumulative (MS15-018) is rated as critical and resolves a number of Memory Corruption vulnerabilities, two elevation of privilege vulnerabilities, and a VBSript memory corruption vulnerability.
  • MS15-019 resolves the same VBScript vulnerability as MS15-018, but for the operating system. Older operating systems will be more susceptible to attack than the newer OSs.
  • MS15-020 resolves two vulnerabilities in the operating system, which could lead to remote code execution.
  • MS15-021 resolves eight vulnerabilities in Adobe Font Driver, which could lead to remote code execution.
  •  MS15-022 resolves five vulnerabilities in Microsoft Office and Sharepoint.  Check out the link to known issues for this update.  There are a lot of links to separate products\versions.  At the time I wrote this blog I could view the bulletin level, but not the list of product specific links on that page.  Also, Sharepoint updates typically cannot be rolled back.  Test before deploying the Sharepoint variations.  If you are running on a Virtual Machine, you have the luxury of snapshots to make rollback possible.

All five of these updates are critical and all five of these updates resolve vulnerabilities that could be exploited through common social engineering techniques. One of the most common attacks still conducted regularly are phishing and email scams that convince a user to click on content that has been crafted to exploit vulnerabilities such as these.  A recent example (Oct 2014) of an attack like this is the Sandworm attack targeting a known vulnerability in OLE to spy on NATO, EU machines.  A weaponized PowerPoint attached to an email with a convincing enough message could convince at least some of the targeted users to open the attachment allowing it to exploit the system.  There are many cases where a vulnerability like this continues to be exploited well after an update has been released to plug the vulnerability.

The remaining nine updates are all rated as important.

  • MS15-023 resolves multiple vulnerabilities, the worst of which could lead to Elevation of Privileges.  This is one of two Kernel Mode Driver updates this month, which means you should definitely test before rolling out.  Typically if a kernel patch goes bad it would involve a blue screen.
  • MS15-024 resolves a vulnerability in PNG processing which could lead to Information Disclosure.
  • MS15-025 is the second Kernel Mode Driver update this month, so again, test before rolling out.  It also resolves vulnerabilities which could lead to Elevation of Privilege.  This bulletin also has some known issues.  Check out the known issues on the KB3038680 page for more details (at the time of publishing, I was getting a Ooops page)
  • MS15-026 resolves vulnerabilities in Exchange server, which could lead to Elevation of Privilege.  This is one of those rare bulletins which DOES NOT require a reboot.  Most require or 'may' require a reboot, which really means it will more than likely require reboot.
  • MS15-027 resolves a vulnerability in NETLOGON which could lead to a spoofing attack.
  • MS15-028 resolves a vulnerability in Windows Task Scheduler that could allow Security Feature Bypass letting the attacker execute tasks they should not have permissions to access.
  • MS15-029 resolves a vulnerability in Windows Decoder which could lead to information disclosure using a specially crafted JPEG.
  • MS15-030 resolves a vulnerability in Remote Desktop Protocol which could lead to a Denial of Service attack.
  • MS15-031 resolves a vulnerability in Schannel which could allow Security Feature Bypass using the FREAK technique, which was recently disclosed.

Join our Patch Tuesday webinar on Wednesday March 11th at 10am CDT to discuss the updates, priorities, and possible known issues to watch out for this Patch Tuesday.