Microsoft quashes critical bugs in IE10, Windows 8, Word
Drive-by attacks possible against IE9, IE10, as well as Word 2007 and Word 2010
Computerworld - Microsoft today patched a dozen vulnerabilities in Internet Explorer (IE), Windows, Word and Exchange, fixing flaws in the new IE10 for the first time and crushing bugs in Windows 8 and Windows RT for the second month running.
Five of Tuesday's seven security updates were marked "critical," Microsoft's most-severe ranking, while the remaining two were labeled "important." Of the 12 vulnerabilities, nine were critical.
Most security experts focused on two of the seven bulletins, Microsoft's term for a product security update: MS12-077, which patches three bugs in IE9 and IE10; and MS12-079, a one-bug update for Word 2003, 2007 and 2010.
MS12-077 was at the top of the list for both Andrew Storms, director of security operations at nCircle Security, and Jason Miller, VMware's manager of research and development. Both cited the importance of browser bugs because of the massive amount of time users spend in those applications as well as the frequent exploitation of browsers by attackers.
"For Microsoft, this is a pretty typical [patch] day," said Storms. "So IE should be first."
"Whenever there's an IE update, unless it has maybe just one vulnerability, it is pretty much at the top of any list," echoed Miller.
This was the second consecutive month that Microsoft patched IE. Last July, Microsoft announced it was ditching the years-long practice of updating IE on alternate months, saying it now had sufficient resources to tackle browser bugs in any month. The company patched IE in June, July and August to demonstrate its new capabilities before pausing.
Today's IE update patches three bugs in IE9 and one in IE10. It also addressed the underlying issues in older editions -- IE6, IE7 and IE8 -- but did not classify them as actual vulnerabilities, probably because while they contained flawed code, exploits written for the newer versions would not execute on their ancestors.
Microsoft calls such fixes "defense-in-depth" updates.
MS12-077 was the first Microsoft bulletin to address a bug in IE10, which debuted Oct. 26 alongside Windows 8 and Windows RT, the tablet-leaning spin-off. In its advisory, Microsoft also said it was patching the preview of IE10 on Windows 7. The sneak peek debuted four weeks ago.
IE10 also received an update today for Adobe's Flash Player, the popular media software that's baked into Microsoft's newest browser. Last month, Adobe said it would adopt the "Patch Tuesday" schedule of its Redmond, Wash. partner for future Flash security updates. Today's update, the 10th for Flash this year, contains fixes for three critical flaws.
Also bright on security professionals' radar was the Word update, MS12-079, which corrects another flaw in the word processor's parsing of RTF (rich text format) files.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Accelerating Network Convergence in Virtualized and Cloud Data Centers Adopting a converged networking strategy enables organizations to traffic server and storage I/O workloads on consolidated data throughput channels. Intelligent software helps optimize...
- Omnichannel: From Buzzword to Strategy Customers demand a seamless experience across channels, especially mobile. Read this whitepaper for a research-based framework for using omnichannel for higher customer engagement.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts