Secure IT Alert: Windows Critical Updates Address Wireless Bluetooth Attack & More

Homeland Secure IT Alert

Homeland Secure IT Alert for Tuesday, July 12, 2011

If you are running any current version of Windows, then Microsoft has something you want, and need.

Today’s “Patch Tuesday” brings a correction to a Bluetooth vulnerability that would permit an attacker to gain complete control over your machine.

Here’s the rundown from the Watchguard Security Center:

Severity: High

12 July, 2011

Summary:

These vulnerabilities affect: All current versions of Windows and components that ship with it
How an attacker exploits them: Multiple vectors of attack, including sending specially crafted wireless Bluetooth traffic
Impact: An attacker can gain complete control of your Windows computer
What to do: Install the appropriate Microsoft patches immediately, or let Windows Automatic Update do it for you.

Exposure:

Today, Microsoft released three security bulletins describing 21 vulnerabilities that affect Windows and components that ship with it. Each vulnerability affects different versions of Windows to varying degrees. However, a remote attacker could wirelessly exploit the worst of these flaws to gain complete control of your Windows PC. The summary below lists the vulnerabilities, in order from highest to lowest severity (according to Microsoft’s summary).

MS11-053: Bluetooth Stack Code Execution Vulnerability

Bluetooth is an open wireless technology and standard for transmiting data over short distances. The Bluetooth stack that ships with more recent versions of Windows suffers from a code execution vulnerability involving how it accesses memory that hasn’t been deleted or initialized. By wirelessly sending a series of specially crafted Bluetooth packets, an attacker could leverage this flaw to gain complete control of your vulnerable computers. However, an attacker would need to remain in Bluetooth range to carry out this attack. The average range of Bluetooth varies from 5 to 100 meters. However, using special gear, Bluetooth “Snipers” have extended the range up to a Kilometer. This flaw only affects Windows Vista and 7.
Microsoft rating: Critical

MS11-054 15 Kernel-Mode Driver Elevation of Privilege Flaws

The kernel is the core component of any computer operating system. Windows also ships with a kernel-mode device driver (win32k.sys) which handles many kernel-level devices. This kernel-mode driver suffers from 15 elevation of privilege (EoP) vulnerabilities. The flaws all differ technically, but generally share the same scope and impact. By running a specially crafted program, a local attacker could leverage these flaws to gain complete control of your Windows computers. However, the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of this flaw.
Microsoft rating: Important

MS11-056: CSRSS Local Elevation of Privilege Vulnerability

The Client/Server Run-time SubSystem (CSRSS) is an essential Windows component responsible for console windows and creating and deleting threads. It suffers from five technically different, but functionally similar, Elevation of Privilege (EoP) vulnerabilities. Like the Kernel-Mode Driver flaw above, by running a specially crafted program, an authenticated attacker could leverage these flaws to gain complete, SYSTEM-level control of your Windows computers. However, like before, the attacker would first need to gain local access to your Windows computers using valid credentials, which somewhat reduces the risk of these flaws.

Microsoft rating: Important

Solution Path:

Microsoft has released patches for Windows which correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately. If you choose, you can also let Windows Update automatically download and install these for you.

MS11-053:

* Note: Windows Vista SP1 is only affected if you install the optional Feature Pack for Wireless

MS11-054:

MS11-056:

For All WatchGuard Users:

Attackers exploit these flaws either locally, or via Bluetooth Wireless transmitions. WatchGuard’s wired and 802.11 wireless appliances do not protect these vectors. Therefore, installing Microsoft’s updates is your most secure course of action.

Status:

Microsoft has released patches correcting these issues.

References:

Microsoft Security Bulletin MS11-053
Microsoft Security Bulletin MS11-054
Microsoft Security Bulletin MS11-056

This alert was researched and written by Corey Nachreiner, CISSP.

Normally, Watchguard would have a way to protect at the firewall, but unfortunately in this situation, this is all computer level…. We suggestion apply these patches ASAP, or optionally, disable Bluetooth until it is resolved.

There is also a MS Visio issue that is resolved today which could result in opening a malicious Visio 2003 document and having code executed, or complete control of your machine given to a remote user!

If you require assistance with these or any other patches in the Greenville or Upstate, SC area, please call 864.990.4748 or email info@homelandsecureit.com