Eveything and Everyone Impacted this Patch Tuesday; Eliminating Admin Priviliges on End-user Workstations.

This information based on my previous blog "Microsoft security updates due next week"

Wow, everything and everyone is affected by this month’s Patch Tuesday:

Domain controllers:  2 very important bulletins address vulnerabilities present in domain controllers.  I recommend you immediately apply MS08-060 (Windows 2000 DCs only) and MS08-063 to your domain controllers after minimal or no testing.

Servers: In my chart below note that there are 4 bulletins impact primarily servers and that there is also a patch specific to HIS (mainframe/AS400 connectivity).  In particular, take note of MS08-062 which is already being exploited in attacks.  If you use Internet Printing Protocol patch such systems immediately.

SharePoint: This month’s Excel bulletin (MS08-057) impacts MOSS 2007 servers so make sure you patch them too.

Workstations and Terminal Servers: As usual most (8 out of 11) bulletins workstation centric.  In particular watch out for MS08-058 which addresses some nasty IE bugs and MS08-061 both of whose exploit details are already public.

I’d also like to bring your attention to the point frequently made in MS security bulletins: “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights

 Here's chart:

Bulletin	Exploit Types /Technologies Affected	System Types Affected	Exploit details public? / Being exploited?	Comprehensive, practical workaround available?	MS severity rating	Products Affected	Notes	Randy's recommendation
MS08-056 957699	Information Disclosure /Office	Terminal Servers and Workstations	No/No	Not unless you can live with file downloads disabled in IE	Moderate	Office XP SP3		Disable CDO or patch (does same thing)
MS08-057 956416	Remote Code /Office Excel	Terminal Servers and Workstations SharePoint Servers	No/No	No	Critical	Office 2000 Office 2003 Office XP Office 2007 MOSS 2007 Mac Office 2004/2008	Viewers and compatibility packs also affected	Patch after testing
MS08-058 956390	Remote code, Information Disclosure /Internet Explorer	Terminal Servers and Workstations	Yes/No	No	Critical	Windows 2000 Windows XP Server 2003 Vista Windows 2008	Cumulative update addresses 6 vulnerabilities; Restart Req’d	Patch ASAP after testing
MS08-059 956695	Remote Code  /Host Integration Server	Servers	No/No	Yes	Critical	Host Integration Server 2000, 2004, 2006		Apply workaround(s) or  patch after testing
MS08-060 957280	Remote code, DOS /Active Directory	DOMAIN CONTROLLERS	No/No	No	Critical	Server 2000	Only domain controllers affected; Restart Req’d	Patch immediately
MS08-061 954211	Privilege Elevation /Windows	Terminal Servers and Workstations	Yes/No	No	Important	Windows 2000 Windows XP Server 2003 Vista Windows 2008	Restart Req’d	Patch after testing
MS08-062 953155	Remote Code /Windows Internet Printing	Servers	No/Yes	Yes	Important	Windows 2000 Windows XP Server 2003 Vista Windows 2008	Vista not vulnerable at this time but patch will be offered	Immediately patch systems with IPP enabled
MS08-063 957095	Remote Code /Windows	Servers or workstations that allow file shares DOMAIN CONTROLLERS	No/No	No	Important IMO: Critical	Windows 2000 Windows XP Server 2003 Vista Windows 2008	Restart Req’d	Patch ASAP after testing
MS08-064 956041	Privilege Elevation /Windows	Terminal Servers and Workstations	No/No	No	Important	Windows XP Server 2003 Vista Windows 2008	Restart Req’d	Patch after testing
MS08-065 951071	Remote Code /Windows	Servers, Terminal Servers and Workstations	No/No	Yes	Important	Windows 2000	Restart Req’d	Disable Message Queue via Group Policy or patch ASAP after testing
MS08-066 956803	Privilege Elevation /Windows	Terminal Servers and Workstations	No/No	No	Important	Windows XP Server 2003	May have issue with ZoneAlarm; Restart Req’d	Patch after testing

Happy patching!!!

Thanks as always for reading and best wishes on security.

Courtesy: Randy F. Smith

www.ultimatewindowssecurity.com