Microsoft MS12-063 – Critical Cumulative Security Update for Internet Explorer

Microsoft released MS12-063, a cumulative update for Internet Explorer addressing Security Advisory 2757760 as well as four other critical-class remote code execution issues.  The update requires a restart.

The Bulletin addresses the following issues from the Common Vulnerabilities and Exposures (CVE) list:

• OnMove Use After Free Vulnerability - CVE-2012-1529.
• Event Listener Use After Free Vulnerability - CVE-2012-2546.
• Layout Use After Free Vulnerability - CVE-2012-2548.
• cloneNode Use After Free Vulnerability - CVE-2012-2557.
• execCommand Use After Free Vulnerability - CVE-2012-4969.

Internet Explorer 10 on Windows 8 and Windows Server 2012 is not affected.  All other versions of Internet Explorer are affected

Support

The following additional information is provided in the Security Bulletin:

• The affected software listed have been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
• Security solutions for IT professionals: TechNet Security Troubleshooting and Support
• Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
• Local support according to your country: International Support

References

• MSRC: Microsoft releases MS12-063 – Cumulative Security Update for Internet Explorer
• TechNet: Microsoft Security Bulletin MS12-063 - Critical

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Out of Band Internet Explorer Security Update

On Friday, September 21, 2012, Microsoft  will release MS12-063, a cumulative update for Internet Explorer addressing Security Advisory 2757760 as well as four other critical-class remote code execution issues.  The update will require a restart.

Microsoft Fix it

In addition, a Microsoft Fix it solution is available now for applying ahead of the update to protect your computer.

Enable	Disable
Fix this problem Microsoft Fix it 50939	Fix this problem       Microsoft Fix it 50938

(HT:  ky331)

References

• MSRC Blog:  Internet Explorer Fix it available now; Security Update scheduled for Friday
• TechNet: Microsoft Security Bulletin Advance Notification for September 2012 
• Microsoft Security Advisory: Vulnerability in Internet Explorer could allow remote code execution

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Microsoft Security Advisory 2757760

Microsoft released Security Advisory 2757760 to address an issue that affects all versions of Internet Explorer except IE10.

Current exploits of this vulnerability occur with Internet Explorer using third-party software, most particularly Oracle’s Java, when visiting a website hosting malicious code.

Update:  It was reported at the MSRC Blog that a Microsoft Fix it solution will be issued within the next few days.  In the interim, it was also stated that this vulnerability is currently not widespread.  See the update at Additional information about Internet Explorer and Security Advisory 2757760.

Recommendations:

Uninstall Java -- Most home computer users no longer need Java.  Following are reasons why someone may need Oracle Sun Java installed on their computer:

• Playing on-line games generally requires Java.
• With OpenOffice, Java is needed for the items listed  here. 
• It used to be that Java was needed for websites to be properly displayed. However, that is generally not the case now with Flash having taken over.
• There may be commercial programs that depend on Java. If Java is needed for a software installed on your computer, there should be a prompt for it.

If you need Java, be sure you have uninstalled all old, vulnerable versions and have only the most recent release installed on your computer.

Install and configure EMET -- The Enhanced Mitigation Experience Toolkit was designed to help prevent hackers from gaining access to your system. It prevents exploitation by applying in-box mitigations such as DEP to configured applications.

The simple steps needed to add iexplore.exe to EMET and other actions are provided in the "Suggested Actions" section of the Security Advisory.  When checking EMET, I was pleased to see that I had already added iexplore.exe. 

References:

• MSRC: Microsoft Releases Security Advisory 2757760
• Tech Net Advisory: Microsoft Security Advisory (2757760) Vulnerability in Internet Explorer Could Allow Remote Code Execution
• Download:  EMET (Enhanced Mitigation Toolkit v3.0)

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...