Sixteen bulletins, four of them critical, patching a total of 49 vulnerabilities, comprise today’s round of patches for Microsoft’s largest ever Patch Tuesday breaking it’s previous record of 34 in 2010 August. Nine of the patch bulletins describe vulnerabilities which can be remotely exploited to inject and execute code on a victim’s system. The updates are likely to plug two vulnerabilities used by Stuxnet to elevate its privileges on infected systems.
Stuxnet was specifically written to attack Supervisory Control And Data Acquisition (SCADA) systems used to control and monitor industrial processes. Stuxnet includes the capability to reprogram the programmable logic controllers (PLCs) and hide the changes. According to a PC World report, “… Ralph Langner, a well-respected expert on industrial systems security, published an analysis of the worm, which targets Siemens software systems, and suggested that it may have been used to sabotage Iran’s Bushehr nuclear reactor. A Siemens expert, Langner simulated a Siemens industrial network and then analyzed the worm’s attack.”