Attack Vector | Microsoft Security Response Center

MS12-054: Not all remote, pre-auth vulnerabilities are equally appetizing for worms..

Tuesday, August 14, 2012

We released security update MS12-054 to address four privately reported issues in Windows networking components failing to properly handle malformed Remote Administration Protocol (RAP) responses. The most severe of these issues, CVE-2012-1851, is a format string vulnerability in the printer spooler service while handling a response message and is a wormable-class vulnerability on Windows XP and Windows Server 2003.

Assessing risk for the July 2012 security updates

Tuesday, July 10, 2012

Today we released nine security bulletins addressing 16 CVE’s. Three of the bulletins have a maximum severity rating of Critical and the other six have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-ability Likely first 30 days impact Platform mitigations and key notes MS12-043(MSXML) Victim browses to a malicious webpage.

Assessing risk for the June 2012 security updates

Tuesday, June 12, 2012

Today we released seven security bulletins. Three have a maximum severity rating of Critical and the other four have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-ability Index Likely first 30 days impact Platform mitigations and key notes MS12-037(Internet Explorer) Victim browses to a malicious webpage.

MS12-034: Duqu, ten CVE's, and removing keyboard layout file attack surface

Tuesday, May 08, 2012

There are several interesting “stories” to tell about security update MS12-034: Addressing the Duqu vulnerability again? Why so many affected products? Keyboard layout behavior introduced with Windows Vista conditionally applied down-level Addressing the Duqu vulnerability again? Five months ago, we released security update MS11-087 to address CVE-2011-3402, a vulnerability that was being exploited by the Duqu malware to execute arbitrary code when a user opened a malicious Office document.

Assessing risk for the April 2012 security updates

Tuesday, April 10, 2012

Today we released 6 security bulletins. Four have a maximum severity rating of Critical with the other two addressing Important class vulnerabilities. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-ability Rating Likely first 30 days impact Platform mitigations and key notes MS12-027(Windows Common Controls) Attackers have leveraged this vulnerability in limited, targeted attacks by emailing malicious RTF file to victims.

MS12-025 and XBAP: No longer a driveby threat

Tuesday, April 10, 2012

One of the security bulletins released today, MS12-025, addresses a code execution vulnerability in the .NET Framework. To exploit the vulnerability, an attacker would build a malicious XBAP application and lure victims to a malicious website serving the XBAP. The good news is that a zero-click “driveby” style attack is no longer possible from the Internet on workstations where MS11-044 (published June 2011) has been installed.

Assessing risk for the February 2012 security updates

Tuesday, February 14, 2012

Today we released nine security bulletins. Four have a maximum severity rating of Critical with the other five having a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-ability Likely first 30 days impact Platform mitigations and key notes MS12-010(Internet Explorer) Victim browses to a malicious website.

MS12-014: Indeo, a blast from the past

Tuesday, February 14, 2012

Today, we shipped security update MS12-014 to address an issue in the Indeo codec. With this blog post, we hope to preemptively answer some common questions that are likely to surface as researchers analyze this security update. Indeo: Blast from the Past Indeo is a video codec that was first developed in 1992, long before some of you reading this blog post were born.

Attack Vector

Assessing risk for the January 2012 security updates

Tuesday, January 10, 2012

Today we released seven security bulletins. One has a maximum severity rating of Critical with the other six having a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-ability rating Likely first 30 days impact Platform mitigations and key notes MS12-004(Windows Media) Victim browses to a malicious website or opens a malicious media file.

Assessing the risk of the December 2011 security updates

Tuesday, December 13, 2011

Today we released thirteen security bulletins. Three have a maximum severity rating of Critical with the other ten having a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max Exploit-Ability Index Likely first 30 days impact Platform mitigations and key notes MS11-087 (TTF Font parsing) Victim opens a malicious Office document or browses to a malicious website.