Microsoft patches critical Outlook drive-by bug

Also ships first fix for DLL load hijacking flaw in Office 2007/2010 as part of 11-patch security update

Microsoft today patched 11 vulnerabilities, including one in Office that hackers will quickly exploit to launch drive-by attacks, said security experts.

As expected, Microsoft did not ship a fix for the flaw in Internet Explorer (IE) that criminals are currently using to hijack Windows PCs.

Of the 11 flaws addressed in three separate updates, only one was pegged as "critical," Microsoft's top ranking in its four-step scoring system. The remaining 10 were all marked "important," the second-highest rating.

"The one that gives me the heebie-jeebies this month is the Office update," said Andrew Storms, director of security operations at nCircle Security. "The RTF vulnerability can be triggered simply by viewing a message in Outlook, so all you have to do is receive a [malicious] message. Then the game is over."

Storms was referring to MS10-087, a five-patch update for Office XP, 2003, 2007 and 2010 on Windows, and Office for Mac 2004, 2008 and 2011.

The only critical bug this month is in the RTF (rich text format) parser within Outlook, the e-mail client packaged with Office. "The vulnerability could be exploited when the specially crafted RTF e-mail message is previewed or opened in Outlook," Microsoft's advisory stated.

"That's a classic drive-by," echoed Amol Sarwate, manager of Qualys' vulnerabilities research lab.

Both Office 2007 and Office 2010, Microsoft's two newest suites, can be exploited using drive-by attacks launched against Outlook. Today's patch was the first critical update for Office 2010, which launched only in June.

Other researchers, including Microsoft's own security team, said that the RTF flaw was the most serious of the month's bugs, and urged users to patch pronto.

"This is one that requires no user interaction," said Jason Miller, the data and security team manager for Shavlik Technologies. "RTF is a common document format like PDF that's not blocked by firewalls or at the e-mail gateway. Once a [malformed] message hits the Outlook preview pane, remote code can be executed. You should patch this right away."

Because the RTF vulnerability doesn't require the user to do anything other than to preview a message, it will probably be exploited almost immediately by attackers, said Miller.

Microsoft patched a similar vulnerability in RTF document parsing in August with MS10-056. In that bulletin, the company labeled one of two RTF-related bugs as critical in Office 2007.

The MS10-087 update also included the first fix by Microsoft for the "DLL load hijacking" or "binary planting" vulnerability class that researchers disclosed last summer. Office 2007 and Office 2010 were both patched to protect users from DLL load hijacking attacks.

In mid-August, noted vulnerability researcher HD Moore announced that he'd uncovered scores of Windows applications that didn't call code libraries -- dubbed "dynamic-link library," or "DLL" -- using the full path name, but instead used only the file name, giving hackers an attack window if they were able to trick an application into loading a malicious file with the same name as a required DLL.

Other researchers named some Microsoft software, including Office 2007, as among those that could be exploited by rogue DLLs.

Since August, Microsoft has repeatedly declined to confirm which of its products were vulnerable to DLL load hijacking attacks, or when it would start patching them.

"For all the hoopla that came out about DLL load hijacking, this is being patched kind of quietly," said Storms.

In MS10-088, Microsoft also patched a pair of vulnerabilities in editions of PowerPoint included with Office XP and Office 2003.

The last of the three bulletins, MS10-089, fixed four flaws in the Forefront Unified Access Gateway (UAG), the virtual private networking (VPN) technology Microsoft acquired in 2006 when it bought the Israeli firm Whale Communications. Three of the bugs could be used by hackers to launch cross-site scripting attacks, said Microsoft.

Miller noted that Microsoft isn't delivering the UAG patches through its normal distribution channels of Windows Update, Microsoft Update or Windows Server Update Services (WSUS), but instead has told customers that they need to manually download the updates from the firm's Web site.

Apparently, Microsoft has not had time to thoroughly test the patch delivery process for the UAG vulnerabilities. "These updates will also be provided through our other standard distribution methods once testing has been completed to ensure distribution will be successful through these channels," Microsoft acknowledged in the MS10-089 bulletin.

"Administrators need to pay attention to this one," said Miller, because Microsoft has departed from its usual practice of pushing patches. "This is very unusual," he added.

Although the experts said they had not expected Microsoft to patch IE's newest vulnerability today, they agreed that the company's hand may be forced before Dec. 14, the next regularly-scheduled Patch Tuesday.

"Whether they patch it before then will depend on how many attacks pop up," said Miller.

"They'll wait and see if a critical mass of exploits appear," echoed Sarwate. "I think they have a fix ready, so if they see some movement [in the number of attacks], they'll probably release an out-of-band update."

While security companies have seen only a few attacks exploiting the IE vulnerability so far, some researchers have reported that the exploit has been added to a popular crimeware kit, a move that will probably boost the number of attacks and pressure Microsoft into shipping an emergency update.

Join the CSO newsletter!

Error: Please check your email address.

Tags MicrosoftsecuritySecurity Hardware and SoftwareWindowssoftwareoperating systems

More about Andrew Corporation (Australia)GatewayGatewayMicrosoftnCircleQualysShavlikShavlik Technologies

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place