Microsoft Security Bulletin Advance Notification for December 2012 contains seven bulletins; five critical and two important.

Bulletin 1 adversely affects Internet Explorer 9 & 10, but not 6, 7, and 8, which is unusual. On IE9, it fluctuates from being rated moderate to critical depending on the platform. Since it is a browser vulnerability this should be the first of the patch triage list, as a victim could be compromised by visiting a malicious site via drive-by attack.

With this update, Microsoft will also harden IE6, IE7, and IE8, even though they aren't vulnerable to these vulnerabilities. The vulnerabilities only exist in IE9 and IE10.

Bulletin 3 is a critical bulletin that affects the Microsoft Office suites. Bulletin 3 patches vulnerabilities that are typically used in targeted attacks by sending victims malicious documents. Office updates sometimes fall through the cracks from a priority stand point, but Outlook can be exploited simply by viewing emails, so this should be patched as a priority. Exploits related to this type of bulletin have a long shelf life.

Bulletin 4 is interesting because it fixes vulnerabilities in Microsoft Exchange Server 2007 Service Pack 3, Microsoft Exchange Server 2010 Service Pack 1, and Microsoft Exchange Server 2010 Service Pack 2. This is probably related to Oracle recently updating Outside In, which is used by Microsoft Exchange.

Bulletins 2 and 5, also rated as critical, will affect most consumers and enterprises since they fix vulnerabilities that would allow an attacker to remotely execute code on all Windows platforms. Both of these bulletins fix vulnerabilities that potentially could be leveraged as web-based attacks, however they would be difficult to exploit and achieve remote code execution.

Bulletin 6 is rated as important and affects all supported Microsoft operating systems except for Windows RT. Since it's rated as important it probably requires a special set of circumstances to actually exploit, which would probably require some sort of victim participation such as opening malicious files.

Bulletin 7 is important and only affects Windows Server 2012 and Windows Server 2008 R2. It could allow an attacker to bypass at least one security measure on those operating systems. Since it is rated as important it may only work under limited circumstances and configurations.


Author: Marcus Carey, security researcher at Rapid7.