Update: Microsoft plans 20 patches next week, will fix Duqu and BEAST bugs
Final Patch Tuesday of the year will deliver 14 security updates
Computerworld - Microsoft today announced it will issue 14 security bulletins next week to patch 20 vulnerabilities in Windows, Internet Explorer (IE), Office, and Windows Media Player.
Among the patches will be ones that plug the hole used by the Duqu intelligence-gathering Trojan, and fix the SSL (secure socket layer) 3.0 and TLS (transport layer security) 1.0 bug popularized three months ago by the BEAST, for "Browser Exploit Against SSL/TLS," hacking tool.
"They're all over the map," said Andrew Storms, director of security operations at nCircle Security, describing the wide range of Microsoft products slated for patching. "It looks like a big cleanup, where they're trying to get as much as they can off their plate before the end of the year."
Three of the 14 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step system, while the remaining 11 were marked "important," the second-highest rating.
Bugs in 10 of the updates could be exploited by attackers to remotely plant attack code on unpatched PCs, Microsoft said in its monthly advance notification that precedes each Patch Tuesday. A number of those bulletins were pegged as important, a move Microsoft makes when the bugs cannot easily be exploited because the pertinent components are not switched on by default or because defensive technologies like ASLR and DEP help protect users.
Storms pointed to the IE update as the one that users should apply as soon as possible, advice he -- and other researchers outside Microsoft -- regularly give when Microsoft patches its browser.
"What's kind of weird is that because of the every-other-month [IE patch] cycle, most people are online this month buying things, and not a lot of people will get around to patching," said Storms.
Although Microsoft has gotten into a six-times-a-year patch cadence for IE, Storms questioned whether it was smart to wait until the online spending frenzy to fix browser flaws.
"As we know, once the patches are out, the time necessary to find exploits for the bugs is shorter and shorter now," Storms said. "Why not bring the IE update back a month to November?"
The critical update labeled only as "Bulletin 1" should also be patched pronto, said Marcus Carey, a security researcher with Rapid7.
Carey correlated the versions of Windows affected by Bulletin 1 with those called out over a month ago in a Microsoft security advisory, and concluded that the update will patch the vulnerability exploited by Duqu, malware that some antivirus firms called a possible precursor to the next Stuxnet, the ultra-sophisticated worm that last year sabotaged Iran's nuclear fuel enrichment program.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!