On Thursday, August 4, Microsoft issued their advance notification of the patches scheduled to be released on Tuesday, August 9. The notification identified two patches classified as CRITICAL, nine patches classified as IMPORTANT and two classified as MODERATE. One of the CRITICAL patches applies to installations of Internet Explorer on current all workstation and server operating systems. The second CRITICAL patch only applies to the following Server Operating Systems: Windows Server 2003, Windows Server 2008 and Windows Server 2008R2.
The critical patches address vulnerabilities that would otherwise allow remote code execution to be performed if not addressed. Two of the patches classified as IMPORTANT address remote code execution vulnerabilities. Other vulnerabilities addressed with the IMPORTANT patches correct code that would allow systems to be compromised in the following manner if the systems were left unpatched: Elevation of Privilege, Denial of Service and Information Disclosure.
As of this time, it is unknown, if these vulnerabilities have been publically disclosed and for that reason, it is unknown if exploit code is already available or will materialize soon after Microsoft provides further details (on August 9). Additional information and ISO recommendations will be provided as details are made available.
Update Aug 9
Additional information has been added to the following Microsoft URL – http://blogs.technet.com/b/msrc/archive/2011/08/09/a-live-bluehat-prize-webcast-and-the-august-2011-security-updates.aspx
In summary, the patches associated with Internet Explorer ( http://www.microsoft.com/technet/security/Bulletin/MS11-057.mspx ) include five privately reported vulnerabilities and two publicly reported vulnerabilities. The publicly disclosed vulnerabilities are identified as moderate criticality.
The vulnerabilities patched in MS11-57 are strictly exposures for the workstation environment. For that reason, it is recommended that the patches be applied to workstations as soon as possible.
With the exception of MS11-065 http://www.microsoft.com/technet/security/Bulletin/MS11-065.mspx , no publicly known exploits have been identified.
Additional information on server vulnerabilities
Microsoft Security Bulletin Summary for Aug 2011
- Internet Explorer 6-9 update – Critical
All current workstation and Server OSs are vulnerable to exploits addressed in patch MS11-057. The designation of critical is only assigned to Windows workstation, Windows Server 2003 and Windows 2008 and 2008R2 Itanium installations.
- Vulnerabilities in Windows DNS server – Critical
Windows Server 2008 SP2 (32 and 64 bit) and Windows Server 2008R2 (base and SP1) have a critical vulnerability exposure to a specially crafted NAPTR query sent to a target Windows DNS server. If left unpatched, exploitation could allow remote code execution. The vulnerability is patched in Microsoft update MS11-058.
NOTE: For all versions of Windows Server 2008, the server core installation is affected by this vulnerability.
Additionally, for installations of Windows Server 2003, the vulnerability is assigned a criticality of important as exploitation could only induce a denial of service condition.