Skip to content

Virtual Administrator’s April 2012 Patch Recommendations

We have not uncovered any widespread problems with any of these patches and are releasing all of them.

 

While MS12-027 is the only patch any know exploits, Microsoft rates MS12-023 and  as “Likely to see reliable exploits developed within next 30 days”

MS12-023 fixes several vulnerabilities in Internet Explorer and MS12-024 addresses a security flaw with the handling of portable execution (PE) files.  PE files are not common but this is a serious vulnerability.

 

No out-of-band updates were released during the last month.

 

6 Security Bulletins were released

 

Exploitability

Publically disclosed: None

Being exploited:  MS12-027

Rated CRITICAL: MS12-023, MS12-024, MS12-025, MS12-027

(The Severity Rating System: http://technet.microsoft.com/en-us/security/bulletin/rating )

 

Requires Restart 

Servers: Yes

Workstations: Yes

 

Know Issues per Microsoft

MS12-024, MS12-026, MS12-027

 

 

New Security Bulletins

(MS#/Affected Software/Type)

 

CRITICAL

 

MS12-023: (Internet Explorer) The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.

 

MS12-024: (Windows) The vulnerability could allow remote code execution if a user or application runs or installs a specially crafted, signed portable executable (PE) file on an affected system.

 

MS12-025: (Net Framework) The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs).

 

MS12-027: (Windows Common Controls) The vulnerability could allow remote code execution if a user visits a website containing specially crafted content designed to exploit the vulnerability.

 

IMPORTANT

 

MS12-026: (Forefront UAG) The more severe of the vulnerabilities could allow information disclosure if an attacker sends a specially crafted query to the UAG server.

 

MS12-028: (Office) The vulnerability could allow remote code execution if a user opens a specially crafted Works file.

 

 

Details and Links

 

MS12-023: Cumulative Security Update for Internet Explorer (2675157)

http://technet.microsoft.com/en-us/security/bulletin/ms12-023

Severity: Critical

KB in Kaseya: KB2675157

Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7

Known Issues per MS: None

 

MS12-024: Vulnerability in Windows Could Allow Remote Code Execution (2653956)

http://technet.microsoft.com/en-us/security/bulletin/ms12-024

Severity: Critical

KB in Kaseya: KB2653956

Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7

Known Issues per MS: http://support.microsoft.com/kb/2653956

 

MS12-025: Vulnerability in .NET Framework Could Allow Remote Code Execution (2671605)

http://technet.microsoft.com/en-us/security/bulletin/ms12-025

Severity: Critical

KB in Kaseya: KB2656368, KB2656369, KB2656370, KB2656372, KB2656373, KB2656374, KB2656376, KB2656378

Affected Software: XP, Vista, Server 2003, Server 2008, Server 2008 R2, Windows 7

Known Issues per MS: None

 

MS12-026: Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Allow Information Disclosure (2663860)

http://technet.microsoft.com/en-us/security/bulletin/ms12-026

Severity: Important

KB in Kaseya: KB2649261, KB2649262

Affected Software: Forefront UAG

Known Issues per MS: http://support.microsoft.com/kb/2663860

 

MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258)

http://technet.microsoft.com/en-us/security/bulletin/ms12-027

Severity: Critical

KB in Kaseya: KB2597112,KB2598041,KB2598039,KB2641426,KB2645025,KB2647488,KB2647490,KB2655547,KB2658674,KB2658676,KB2658677,KB983807,KB983808

Affected Software: Office 2003,Office 2007,SQL Server 2000,SQL Server 2005,SQL Server 2008,Visual Basic 6.0,Visual FoxPro 9.0,BizTalk Server 2002,Office 2010,Commerce Server 2002,Commerce Server 2007,Commerce Server 2009,Commerce Server 2009 R2,Visual FoxPro 8.0

Known Issues per MS: http://support.microsoft.com/kb/2664258

 

MS12-028: Vulnerability in Microsoft Office Could Allow Remote Code Execution (2639185)

http://technet.microsoft.com/en-us/security/bulletin/ms12-028

Severity: Important

KB in Kaseya: KB2596871,KB2680317,KB2680326

Affected Software: Office 2007,Works 9,Works 6-9 File Converter

Known Issues per MS: None

Scroll To Top