Today we released thirteen security bulletins addressing 47 CVE’s. Four bulletins have a maximum severity rating of Critical while the other ten have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.
| Bulletin | Most likely attack vector | Max Bulletin Severity | Max Exploit-ability | Likely first 30 days impact | Platform mitigations and key notes |
|---|---|---|---|---|---|
| MS13-069(Internet Explorer) | Victim browses to a malicious webpage. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS13-068(Outlook) | Victim views or previews email having a large number of embedded S/MIME certificates. | Critical | 2 | Unlikely to see reliable exploit code within 30 days. | We’ve written a blog post describing the difficulty attackers would have in exploiting this for code execution: http://blogs.technet.com/b/srd/archive/2013/09/10/ms13-068-a-difficult-to-exploit-double-free-in-outlook.aspx |
| MS13-067(SharePoint) | Attacker engaged in a session with victim SharePoint server tampers with the viewstate value used to maintain state, potentially resulting in code execution server-side. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | By default, SharePoint requires users (including attackers) to authenticate. This is not a pre-authentication vulnerability unless the SharePoint server is configured to not require authentication. |
| MS13-070(OLE32) | Victim opens malicious Visio file. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | Most likely to be exploited via Visio attack vector. But vulnerability is also reachable via shell (Explorer) preview functionality. |
| MS13-072(Word) | Victim opens malicious Word document. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | Office 2013 not affected. |
| MS13-073(Excel) | Victim opens malicious Excel spreadsheet. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS13-074(Access) | Attacker lures victim to double-clicking a malicious Access database (.accdb) | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS13-076(win32k.sys) | Attacker who is already running code on a machine uses this vulnerability to elevate from low-privileged account to SYSTEM. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS13-079(Active Directory) | Attacker sends malicious LDAP request to a domain controller, resulting in a denial of service condition. | Important | n/a | Denial of service only. | |
| MS13-071(Windows Theme) | Attacker lures victim to double-clicking a malicious .theme file. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | Does not affect Windows 7 or later platforms. |
| MS13-075(IME) | Attacker who is already running code on a machine uses this vulnerability to elevate from low-privileged account to SYSTEM. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS13-077(Windows Service Control Manager) | Attacker able to modify the registry on a system uses this vulnerability to elevate from low-privileged account to SYSTEM. | Important | 2 | Less likely to see reliable exploits developed within next 30 days. | |
| MS13-078(FrontPage) | Victim opens malicious XML document in FrontPage, leads to information disclosure. | Important | n/a | Information Disclosure only |
- Jonathan Ness, MSRC Engineering