Microsoft Patch Tuesday: May 2010

With this May Microsoft Patch Tuesday Security Update, we see a relatively light release with just two security updates this month. Both patches are rated as Critical with the potential for remote code execution on the target client. Unfortunately, all patches released this month will most likely require a reboot of the target system. In addition, the ChangeBASE AOK Patch Impact team has updated the sample application database to now more than 2000 unique application packages. All of the applications in this large sample application portfolio are analysed for application level conflicts with Microsoft Security Updates and potential dependencies, or down-level conflicts. Based on the results of our AOK Application Compatibility Lab only one patch will have a minor impact on a standard application portfolio; MS010-031 Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution. We have included a brief snap-shot of some of the results from our AOK Software that demonstrates some of the potential impacts on the OSP application package with the following snap-shot image. MS010-030 Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542). Testing Summary MS10-030 : "Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)" MS10-031 : "Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)" Patch Name Total Issues Matches Affected Reboot Rating RAG Microsoft Security Bulletin MS10-030 <1% <1% YES Moderate impact and negligible testing profile Microsoft Security Bulletin MS10-031 40% 2% YES Marginal impact and negligible testing profile Legend: No Issues Detected Potentially fixable application Impact Serious Compatibility Issue Security Update Detailed Summary MS10-030 MS010-030 Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542) Description This security update resolves a privately reported vulnerability in Outlook Express, Windows Mail, and Windows Live Mail. The vulnerability could allow remote code execution if a user visits a malicious e-mail server. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Payload Directdb.dll, Iecustom.dll, Inetcomm.dll, Inetres.dll, Msident.dll, Msimn.exe, Msoe.dll, Msoeacct.dll, Msoeres.dll, Msoert2.dll, Oeimport.dll, Oemig50.exe, Oemiglib.dll, Wab.exe, Wab32.dll, Wabfind.dll, Wabimp.dll, Wabmig.exe Impact Critical - Remote Code Execution MS10-031 MS010-031: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213) Description This security update resolves a privately reported vulnerability in Microsoft Visual Basic for Applications. The vulnerability could allow remote code execution if a host application opens and passes a specially crafted file to the Visual Basic for Applications runtime. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Payload Vbe6.dll Impact Critical – Remote Code Execution *All results are based on an AOK Application Compatibility Lab’s test portfolio of over 1,000 applications.