Microsoft's holiday bonus: Fixes for 40 flaws
Ships record number of updates, patches critical IE bugs, flaws exploitable through rivals' browsers
Computerworld - Microsoft today patched 40 vulnerabilities in Windows, Internet Explorer (IE), Office, SharePoint and Exchange, including nine pegged "critical."
Five of the 17 security updates -- Microsoft calls them "bulletins" -- fixed long-standing flaws that could be used by attackers to plant malware on a PC by tricking Windows into thinking a malicious DLL (dynamic link library) was actually a legitimate part of the OS.
Only two of the 17 updates were judged critical, Microsoft's top-most threat ranking in its four-step scoring system. Another 14 were marked "important," the second-highest rating, while the remaining update was labeled "moderate."
Microsoft put the spotlight on the two critical bulletins, as did several security experts.
"Both MS10-090 and MS10-091 are pretty critical, I think," said Andrew Storms, director of security operations for nCircle Security. "Microsoft's evaluation seems in line with what I would expect, and shows that they're giving a pretty fair and balanced representation of priorities."
Amol Sarwate, manager of Qualys' vulnerabilities research labs, agreed with Storms, putting those updates at the top of his list, too.
MS10-090 patches seven vulnerabilities in IE, six of them critical and one marked moderate. All supported versions, including 2009's IE8, are affected by one or more of the bugs. IE9, which is still in beta testing, does not harbor any of the seven vulnerabilities, Microsoft said in its advisory.
Among the patched IE bugs were three that had been publicly disclosed before today, and one that hackers have been exploiting for at least the last six weeks.
Microsoft confirmed the latter on Nov. 3 in a security advisory, but was unable to craft and test a patch in time to make it into that month's security update.
MS10-091, which in Microsoft's eyes is a Windows update, also affected browsers -- but not IE directly.
Instead, attackers could exploit the three vulnerabilities in the update -- all rated critical -- through non-Microsoft browsers that support the open-source OpenType font format by simply tricking users into visiting a malicious site.
Microsoft did not list the affected browsers, but the other four of the top five -- Firefox, Chrome, Safari and Opera -- all support OpenType fonts.
It's unclear today whether those browsers need to be patched separately, and if so whether they have been patched. For its part, Microsoft said it had reached out to the other browser makers to let them know about the OpenType bugs it was addressing.
Opera Software, whose security team co-reported one of the three OpenType vulnerabilities to Microsoft, said that other browsers did not need repair.
"The patch for Opera is the referenced Microsoft [MS10-091] patch, as it is not possible for the [browser] to protect itself against the problem, except by disabling webfonts, since the problem is in the OS's handling of fonts," said Thomas Ford, an Opera spokesman.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!