Events

Patch Tuesday June 2012 – IE Client Side and RDP Exposures, 27 Other Vulnerabilities

Microsoft released a set of five bulletins, patching 29 total software vulnerabilities. Multiple remote code execution holes are being patched, but the two most urgent are the Internet Explorer and Remote Desktop Protocol updates. Almost half of the 29 vulnerabilities being patched this month are maintained in versions 6, 7, 8, and 9 of Internet Explorer code, all patched with Security Bulletin MS12-037.

RDP is not enabled by default on Windows systems, but exposure to this month’s remote code execution vulnerability is a problem for many businesses around the world, as the recent activity from the Morto worm demonstrated. Many businesses need to use Remote Desktop functionality and enable it, but don’t understand how to or just don’t bother hiding the port behind a firewall and limiting access or requiring VPN access only. Past pre-authentication vulnerabilities in RDP should have improvded the situation by now, and folks need to understand that this service should be better isolated. We’ll see if this one is taken advantage of in coming weeks. Updating systems with MS12-036 is a priority – including Windows 2003 installs and up to the Server Core installation of Windows Server 2008 R2 for x64-based Systems Service Pack 1. It’s rated critical, and most versions of Windows server OS are vulnerable not only to DoS attacks, but remote code execution.

For most folks, properly licensed Windows systems with Windows Updates enabled will update the software automatically over the next day or so. People can also find “Windows Updates” in their start menu and open it, then click on “Check for Updates”.

Patch Tuesday June 2012 – IE Client Side and RDP Exposures, 27 Other Vulnerabilities

Your email address will not be published.

 

Reports

The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox