Site icon Secplicity – Security Simplified

Microsoft's March Patch Day Madness

Corey Nachreiner

Pull up your bootstraps Microsoft administrators, because you’re in for a long patch slog this month. According to their March Patch Day summary,  Microsoft released 14 security bulletins, many fixing critical issues. I highlight the details below, so get ready to get patching.

By the Numbers:

Today, Microsoft released 14 security bulletins, fixing a total of 45 security vulnerabilities in many of their products. The affected products include:

They rate five bulletins as Critical and the rest as Important.

Patch Day Highlights:

There are many vulnerabilities worth fixing this month, but two major highlights.

  1. Remember FREAK? It’s that SSL implementation vulnerability that I’ve been talking about in blog posts and multiple videos. Well, it affects Windows too and they fixed it this month. If you’ve been concerned about black hats sniffing your SSL, be sure to get the FREAK update (MS15-031).
  2. Also, remember Stuxnet? I’m sure you do, since it was one of the most sophisticated attacks the industry has ever seen. When it was discovered, it used four different zero day vulnerabilities to help itself spread, including a .LNK file vulnerability that helped it infect others via USB storage devices. Microsoft tried to patch this flaw years ago, but apparently failed. The MS15-020 update completes the botched job, so be sure to get that update. If you want to learn more about the update’s relation to Stuxnet, check out this HP blog post.

While these those two updates are probably the most interesting, this month’s bulletins include many more critical patches. For instance, March’s Internet Explorer (IE) update fixes 12 security flaws that bad guys can leverage in drive-by download attacks. Also, Exchange administrators will probably want to apply its update quickly, even though Microsoft only reports it as Important. If attackers can get your email users to click a link, they can exploit various Exchange flaws to gain access to your users’ OWA accounts. In short, we recommend you apply Microsofts updates quickly, in the order we share them below.

Quick Bulletin Summary:

We summarize the March security bulletins below in order of severity. We recommend you apply the updates in the same order of priority, assuming you use the affected products.

Solution Path:

If you use any of the software mentioned above, you should apply the corresponding updates as soon as you can. I recommend you apply the Critical updates immediately, try to get to the Important ones as a soon as possible, and leave the moderate ones for last.

You can get the updates three ways:

  1. Let Windows Automatic Update do it for you – While patches sometimes introduce new problems, these occasional issues don’t seem to affect clients as often as they do servers. To keep your network secure, I recommend you set Windows clients to update automatically so they get patches as soon as possible.
  2. Manually download and install patches – That said, most businesses strongly rely on production servers and server software. For that reason, I recommend you always test new server updates before applying them manually to production servers. Virtualization can help you build a test environment that mimics your production one for testing.  You can find links to download the various updates in the individual bulletins I’ve linked above.
  3. Download February’s full Security Update ISO –  Finally, Microsoft eventually posts an ISO image that consolidates all the security updates. This ISO conveniently packages the updates in one place for administrators. You’ll eventually find a link to the monthly security ISOs here, but Microsoft may not post it until a few days after Patch Day

For WatchGuard Customers:

Good News! WatchGuard’s Gateway Antivirus (GAV), Intrusion Prevention (IPS), and APT Blocker services can often prevent these sorts of attacks, or the malware they try to distribute. For instance, our IPS signature team has developed signatures that can detect and block many of the attacks described in Microsoft’s alerts:

Your Firebox or XTM appliance should get this new IPS signature update shortly.

Furthermore, our Reputation Enabled Defense (RED) and WebBlocker services can often prevent your users from accidentally visiting malicious (or legitimate but booby-trapped) web sites that contain these sorts of attacks. Nevertheless, we still recommend you install Microsoft’s updates to completely protect yourself from all of these flaws. — Corey Nachreiner, CISSP (@SecAdept)

 

Exit mobile version