Microsoft quashes critical bugs in IE10, Windows 8, Word
Drive-by attacks possible against IE9, IE10, as well as Word 2007 and Word 2010
Computerworld - Microsoft today patched a dozen vulnerabilities in Internet Explorer (IE), Windows, Word and Exchange, fixing flaws in the new IE10 for the first time and crushing bugs in Windows 8 and Windows RT for the second month running.
Five of Tuesday's seven security updates were marked "critical," Microsoft's most-severe ranking, while the remaining two were labeled "important." Of the 12 vulnerabilities, nine were critical.
Most security experts focused on two of the seven bulletins, Microsoft's term for a product security update: MS12-077, which patches three bugs in IE9 and IE10; and MS12-079, a one-bug update for Word 2003, 2007 and 2010.
MS12-077 was at the top of the list for both Andrew Storms, director of security operations at nCircle Security, and Jason Miller, VMware's manager of research and development. Both cited the importance of browser bugs because of the massive amount of time users spend in those applications as well as the frequent exploitation of browsers by attackers.
"For Microsoft, this is a pretty typical [patch] day," said Storms. "So IE should be first."
"Whenever there's an IE update, unless it has maybe just one vulnerability, it is pretty much at the top of any list," echoed Miller.
This was the second consecutive month that Microsoft patched IE. Last July, Microsoft announced it was ditching the years-long practice of updating IE on alternate months, saying it now had sufficient resources to tackle browser bugs in any month. The company patched IE in June, July and August to demonstrate its new capabilities before pausing.
Today's IE update patches three bugs in IE9 and one in IE10. It also addressed the underlying issues in older editions -- IE6, IE7 and IE8 -- but did not classify them as actual vulnerabilities, probably because while they contained flawed code, exploits written for the newer versions would not execute on their ancestors.
Microsoft calls such fixes "defense-in-depth" updates.
MS12-077 was the first Microsoft bulletin to address a bug in IE10, which debuted Oct. 26 alongside Windows 8 and Windows RT, the tablet-leaning spin-off. In its advisory, Microsoft also said it was patching the preview of IE10 on Windows 7. The sneak peek debuted four weeks ago.
IE10 also received an update today for Adobe's Flash Player, the popular media software that's baked into Microsoft's newest browser. Last month, Adobe said it would adopt the "Patch Tuesday" schedule of its Redmond, Wash. partner for future Flash security updates. Today's update, the 10th for Flash this year, contains fixes for three critical flaws.
Also bright on security professionals' radar was the Word update, MS12-079, which corrects another flaw in the word processor's parsing of RTF (rich text format) files.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to...
- Building Tomorrow's Infrastructure Listen to this podcast to discover how Crider Foods worked with PC Connection to update their IT infrastructure, while maintaining compliance and control. All Malware and Vulnerabilities White Papers | Webcasts