Microsoft Black Tuesday patches

Microsoft Black Tuesday patches - February 2007

Overview of the February 2007 Microsoft patches and their status.

#	Affected	Contra Indications	Known Exploits	Microsoft rating	ISC rating(*)
#	Affected	Contra Indications	Known Exploits	Microsoft rating	clients	servers
MS07-005	Remote code execution in Step-by-Step Interactive training, replaces MS05-031
MS07-005	Step-by-Step Interactive training CVE-2006-3448	No known problems KB 923723	No known exploits	Important	Important	Less Urgent
MS07-006	Privilege elevation in Windows Shell, replaces MS06-045
MS07-006	Explorer CVE-2007-0211	No known problems KB 928255	No known exploits	Important	Important	Less Urgent
MS07-007	Privilege elevation in Windows Image Acquisition
MS07-007	Image Acquisition CVE-2007-0210	No known problems KB 927802	No known exploits	Critical	Important	Less Urgent
MS07-008	Remote code execution in HTML help Active-X
MS07-008	HTML Help CVE-2007-0214	No known problems KB 928843	Exploit expected to become public soon	Critical	PATCH NOW	Important
MS07-009	Remote code execution in Microsoft MDAC ActiveX Workaround through a killbit, if you did not do that already: PATCH NOW
MS07-009	MDAC ActiveX CVE-2006-5559	No known problems KB 927779	Public exploits since Oct 24th, 2006	Critical	Critical	Important
MS07-010	Remote code execution in Microsoft Malware Protection Engine. This will automatically update.
MS07-010	Microsoft malware protection CVE-2006-5270	No known problems KB 932135	No known exploits	Critical	Critical	Critical
MS07-011	Remote code execution in Microsoft OLE dialog
MS07-011	OLE CVE-2007-0026	No known problems KB 926436	Exploit publicly available	Important	Critical	Important
MS07-012	Remote code execution in Microsoft Foundation Class
MS07-012	Microsoft Foundation Class CVE-2007-0025	No known problems KB 924667	No known exploits	Important	Critical	Important
MS07-013	Remote code execution in RichEdit, also affects Mac OS X versions of office.
MS07-013	Office 1311	No known problems KB 918118	No known exploits	Important	Critical	Important
MS07-014	Multiple vulnerabilities in word leading to remote code execution, replaces MS06-060
MS07-014	Office CVE-2006-5994 CVE-2006-6456 CVE-2006-6561 CVE-2007-0208 CVE-2007-0209 CVE-2007-0515	No known problems KB 929434	Actively used and publicly known exploits.	Critical	PATCH NOW	Important
MS07-015	Multiple vulnerabilities in Office lead to remote code execution, replaces MS06-062
MS07-015	Office CVE-2006-3877 CVE-2007-0671	No known problems KB 932554	Actively exploited	Critical	PATCH NOW	Important
MS07-016	Multiple vulnerabilities in Internet Explorer leading to remote code execution, replaces MS06-072
MS07-016	MSIE CVE-2006-4697 CVE-2007-0219 CVE-2007-0217	No known problems KB 928090	Exploits expected to be released soon	Critical	PATCH NOW	Important

We will update issues on this page as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

--
Swa Frantzen -- NET2S

Swa

760 Posts

Feb 13th 2007
1 decade ago