Microsoft patches critical drive-by IE9 bug, Windows zero-day
Fixes 16 flaws, picks up IE update tempo
Computerworld - Microsoft today patched 16 vulnerabilities, including one in Windows that's been exploited for weeks and two in Internet Explorer 9 (IE9) in the first-in-years back-to-back browser update.
Of Tuesday's nine security updates, three were rated "critical," Microsoft's most-severe threat ranking, while the others were pegged as "important," the next-most-serious label.
Among the products patched today were all versions of Windows; Office 2003, 2007 and 2010 on Windows; Office for Mac 2011; and IE9, Microsoft's newest browser that the company has touted as its most modern and most secure.
The three critical updates -- Microsoft dubs them bulletins -- were the ones tagged by Microsoft and independent security researchers as the first to apply.
As expected, Microsoft fixed a flaw in XML Core Services (MSXML) with MS12-043. The MSXML vulnerability has been actively exploited in targeted attacks against high-value victims, including those in aerospace and defense industries, for weeks. Microsoft acknowledged the attacks almost a month ago, but contrary to some experts' speculation, did not issue an emergency, or "out-of-band," update, instead waiting until the regular Patch Tuesday.
"Exploit code for this was published last week," said Jason Miller, manager of research and development at VMware, referring to attack code going public. "It's a zero-day, so it should be patched as soon as possible."
"It's being leveraged in the wild, so [MS12-043] has to be at the top of everyone's list," echoed Andrew Storms, director of security operations at nCircle Security.
Both Miller and Storms noted that Microsoft did not patch MSXML Core Services 5.0, a version bundled with Office 2003, Office 2007 and other Office-related products and components. "The security updates for Microsoft XML Core Services 5.0 are unavailable at this time," Microsoft said in the accompanying write-up.
"I'm guessing they ran out of time," said Miller of the omission of a patch for MSXML 5.0. "It's better to have something rather than have them wait [for the 3.0 fix] and give us nothing now."
Microsoft has said that all current attacks have exploited the vulnerability in MSXML Core Services 3.0, a version included with Windows.
"The exploit is already out there, so issuing [this partial patch] isn't going to create a detriment for anyone," said Storms. "The big question is 'When are we going to see the patch?'"
The company did not specify when the Core Services 5.0 fix would be released, or when it is finished, whether it would ship before next month's Patch Tuesday.
Both Windows 8 Consumer Preview and the newer Release Preview will also receive the MS12-043 update, Microsoft said.
Second on researchers' list was MS12-044, a two-patch update for IE9.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts