Microsoft quashes critical bugs in IE10, Windows 8, Word
Drive-by attacks possible against IE9, IE10, as well as Word 2007 and Word 2010
Computerworld - Microsoft today patched a dozen vulnerabilities in Internet Explorer (IE), Windows, Word and Exchange, fixing flaws in the new IE10 for the first time and crushing bugs in Windows 8 and Windows RT for the second month running.
Five of Tuesday's seven security updates were marked "critical," Microsoft's most-severe ranking, while the remaining two were labeled "important." Of the 12 vulnerabilities, nine were critical.
Most security experts focused on two of the seven bulletins, Microsoft's term for a product security update: MS12-077, which patches three bugs in IE9 and IE10; and MS12-079, a one-bug update for Word 2003, 2007 and 2010.
MS12-077 was at the top of the list for both Andrew Storms, director of security operations at nCircle Security, and Jason Miller, VMware's manager of research and development. Both cited the importance of browser bugs because of the massive amount of time users spend in those applications as well as the frequent exploitation of browsers by attackers.
"For Microsoft, this is a pretty typical [patch] day," said Storms. "So IE should be first."
"Whenever there's an IE update, unless it has maybe just one vulnerability, it is pretty much at the top of any list," echoed Miller.
This was the second consecutive month that Microsoft patched IE. Last July, Microsoft announced it was ditching the years-long practice of updating IE on alternate months, saying it now had sufficient resources to tackle browser bugs in any month. The company patched IE in June, July and August to demonstrate its new capabilities before pausing.
Today's IE update patches three bugs in IE9 and one in IE10. It also addressed the underlying issues in older editions -- IE6, IE7 and IE8 -- but did not classify them as actual vulnerabilities, probably because while they contained flawed code, exploits written for the newer versions would not execute on their ancestors.
Microsoft calls such fixes "defense-in-depth" updates.
MS12-077 was the first Microsoft bulletin to address a bug in IE10, which debuted Oct. 26 alongside Windows 8 and Windows RT, the tablet-leaning spin-off. In its advisory, Microsoft also said it was patching the preview of IE10 on Windows 7. The sneak peek debuted four weeks ago.
IE10 also received an update today for Adobe's Flash Player, the popular media software that's baked into Microsoft's newest browser. Last month, Adobe said it would adopt the "Patch Tuesday" schedule of its Redmond, Wash. partner for future Flash security updates. Today's update, the 10th for Flash this year, contains fixes for three critical flaws.
Also bright on security professionals' radar was the Word update, MS12-079, which corrects another flaw in the word processor's parsing of RTF (rich text format) files.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Malware and Vulnerabilities White Papers | Webcasts