We have not uncovered any widespread problems with any of these patches and are releasing all of them.
While MS12-027 is the only patch any know exploits, Microsoft rates MS12-023 and as “Likely to see reliable exploits developed within next 30 days”
MS12-023 fixes several vulnerabilities in Internet Explorer and MS12-024 addresses a security flaw with the handling of portable execution (PE) files. PE files are not common but this is a serious vulnerability.
No out-of-band updates were released during the last month.
6 Security Bulletins were released
Exploitability
Publically disclosed: None
Being exploited: MS12-027
Rated CRITICAL: MS12-023, MS12-024, MS12-025, MS12-027
(The Severity Rating System: http://technet.microsoft.com/en-us/security/bulletin/rating )
Requires Restart
Servers: Yes
Workstations: Yes
Know Issues per Microsoft
MS12-024, MS12-026, MS12-027
New Security Bulletins
(MS#/Affected Software/Type)
CRITICAL
MS12-023: (Internet Explorer) The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
MS12-024: (Windows) The vulnerability could allow remote code execution if a user or application runs or installs a specially crafted, signed portable executable (PE) file on an affected system.
MS12-025: (Net Framework) The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs).
MS12-027: (Windows Common Controls) The vulnerability could allow remote code execution if a user visits a website containing specially crafted content designed to exploit the vulnerability.
IMPORTANT
MS12-026: (Forefront UAG) The more severe of the vulnerabilities could allow information disclosure if an attacker sends a specially crafted query to the UAG server.
MS12-028: (Office) The vulnerability could allow remote code execution if a user opens a specially crafted Works file.
Details and Links
MS12-023: Cumulative Security Update for Internet Explorer (2675157)
http://technet.microsoft.com/en-us/security/bulletin/ms12-023
Severity: Critical
KB in Kaseya: KB2675157
Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7
Known Issues per MS: None
MS12-024: Vulnerability in Windows Could Allow Remote Code Execution (2653956)
http://technet.microsoft.com/en-us/security/bulletin/ms12-024
Severity: Critical
KB in Kaseya: KB2653956
Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7
Known Issues per MS: http://support.microsoft.com/kb/2653956
MS12-025: Vulnerability in .NET Framework Could Allow Remote Code Execution (2671605)
http://technet.microsoft.com/en-us/security/bulletin/ms12-025
Severity: Critical
KB in Kaseya: KB2656368, KB2656369, KB2656370, KB2656372, KB2656373, KB2656374, KB2656376, KB2656378
Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7
Known Issues per MS: None
MS12-026: Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Allow Information Disclosure (2663860)
http://technet.microsoft.com/en-us/security/bulletin/ms12-026
Severity: Important
KB in Kaseya: KB2649261, KB2649262
Affected Software: Forefront UAG
Known Issues per MS: http://support.microsoft.com/kb/2663860
MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258)
http://technet.microsoft.com/en-us/security/bulletin/ms12-027
Severity: Critical
KB in Kaseya: KB2597112,KB2598041,KB2598039,KB2641426,KB2645025,KB2647488,KB2647490,KB2655547,KB2658674,KB2658676,KB2658677,KB983807,KB983808
Affected Software: Office 2003,Office 2007,SQL Server 2000,SQL Server 2005,SQL Server 2008,Visual Basic 6.0,Visual FoxPro 9.0,BizTalk Server 2002,Office 2010,Commerce Server 2002,Commerce Server 2007,Commerce Server 2009,Commerce Server 2009 R2,Visual FoxPro 8.0
Known Issues per MS: http://support.microsoft.com/kb/2664258
MS12-028: Vulnerability in Microsoft Office Could Allow Remote Code Execution (2639185)
http://technet.microsoft.com/en-us/security/bulletin/ms12-028
Severity: Important
KB in Kaseya: KB2596871,KB2680317,KB2680326
Affected Software: Office 2007,Works 9,Works 6-9 File Converter
Known Issues per MS: None
