Microsoft’s patch release for April contains 11 bulletins covering 25 vulnerabilities. The bulletins address a wide array of operating systems and software packages, IT administrators with a good inventory of their installed base will have an easier time evaluating which machines need patches.
Microsoft patches 2 open 0-day vulnerabilities – MS10-020 for the SMBv2 Denial of Service vulnerability, only present on Windows 7 and Windows Server 2008 (KB977544) and MS10-022 for the F1 attack through Internet Explorer (KB981169). MS10-020 fixes other SMB vulnerabilities as well and is a critical update for all platforms.
The most critical bulletins this month are MS10-026, MS10-027 and MS10-019. MS10-026 addresses a DirectShow vulnerability that can be exploited through visualizing a media file which can lead to remote code execution. MS10-027 is a Windows Media Player Active X control vulnerability which can lead to similar results. Both are relatively easy to exploit and have a low exploitability index, however Windows 7 users are not affected by either of the vulnerabilities. MS10-019 addresses a flaw in the Windows Authenticode algorithm involved during the installation process of new software. The flaw allows for a downgrade from the current v2 Authenticode algorithm to the deprecated v1 algorithm. If an attacker follows this downgrade with an attack on v1 (a sophisticated multi-stage attack), he could pass off malicious install packages as legitimately signed by major manufacturers. This vulnerability has a exploit rating of difficult, meaning that even advanced attackers will take a while to come up with the necessary exploit code – still we recommend patching this during the normal cycle for all machines.
MS10-025 is a critical Windows Media Services vulnerability but only affects Windows 2000. Windows 2000 Server will have its extended Support retired in mid-July of this year and will then cease to receive security updates. Organizations that still use Windows 2000 need to evaluate a migration strategy.
The remaining bulletins are ranked as important and moderate – MS10-028 is a file format attack against Visio, which can result in remote code execution. MS10-023 is a similar attack against Microsoft Publisher. As these software packages are not widely installed a good inventory will be helpful in evaluating the exposure. MS10-021 is an interesting side effect created by registry linking. MS10-024 is a Denial of Service vulnerability in the SMTP server of Windows 2003-64bit only and MS10-029 an IPv6/IPv4 packet envelope vulnerability that can lead to information disclosure.
This is a big release for Microsoft, addressing a wide selection of software. IT administrators probably will not have all of the included software packages and configurations installed in their environment and therefore will need to install only a subset of the 11 bulletins.
In addition Adobe released their quarterly patches for Adobe Reader and Acrobat on Windows, Mac OS X and Unix. The update is critical and fixes multiple 15 vulnerabilities with a maximum exposure of "remote code execution".