Microsoft kicks off 2013 with clutch of critical Windows updates
Others, including Adobe, Google and Mozilla ride Patch Tuesday's coat tails
Computerworld - Microsoft today patched 12 vulnerabilities in Windows, Office and several server and development products, but as it hinted last week, did not come up with a fix for the Internet Explorer (IE) bug that cyber criminals have been exploiting for at least a month.
Today was also a spring tide of sorts for patching, as Microsoft's updates were just some that vendors pushed to customers. Adobe also issued updates for Flash Player, Adobe Reader and Adobe Acrobat; Google shipped a new version of Chrome; and Mozilla delivered the next iteration of Firefox.
"More vendors are aligning with Patch Tuesday," said Jason Miller, VMware's manager of research and development. "That's not necessarily a bad thing, but with so many, it makes it harder to get your hands around what needs to be patched."
Two of Microsoft's seven security updates were marked "critical," Microsoft's highest-threat rating. The other five were tagged "important." Of the 12 vulnerabilities, only three were critical.
Security experts voted MS13-002, one of the two critical updates, as requiring immediate attention. The one-vulnerability update addressed a bug in XML Core Services (MSXML) in every supported edition of Windows, from the 11-year-old Windows XP to the two-month-old Windows 8 and Windows RT.
MSXML was last patched by MS12-043, another critical update, released in July. That vulnerability was one of several allegedly uncovered, then exploited, by an elite hacker group dubbed "Elderwood" by Symantec, which in September said the gang had an inexhaustible supply of "zero-day" bugs at its disposal.
"MS13-002 is at the top of the list because it affects so many components, applications and operating systems," said Andrew Storms, director of security operations at nCircle Security. Last week, Storms put his money on XML or GDI as the likely culprits for what Microsoft called "Bulletin 2" in its monthly advance notification for today's fixes.
Miller agreed. "Many users will have multiple XML Cores on their system, so there may be more than one patch applied," he warned.
MS13-002 affected not only Windows, but as Storms and Miller said, also Office 2003 and Office 2007; Expression Web, part of the Expression Studio web development suite; and SharePoint Server 2007, Groove Server 2007 and System Center Operations Manager 2007.
A few researchers dissented on the first-to-patch roll call. Paul Henry, a security and forensic analyst at Lumension, picked MS13-001 instead.
"[This] is probably the most important vulnerability," Henry said in an email. "From an attack perspective, you could create a bunch of print jobs with malformed headers, send them to the network printer so they queue up in order, and if someone else on the network prints to the same printer, Print Spooler will actually go through and enumerate all the pending print jobs, which gives you the remote code execution."
Storms and Miller, who both picked MS13-001 for this month's No. 2 spot, thought the single-vulnerability update was as interesting as did Microsoft, which detailed the bug on its Security Research & Defense blog today.
The vulnerability in Windows Print Spooler -- but only in the code contained within Windows 7 and Windows Server 2008 R2 -- could be used by attackers, who must already have network access, to spread malware within an enterprise, where shared printers and multi-function devices are a dime a dozen.
"[MS13-001] was disconcerting at first, reminded me of Stuxnet," said Storms, talking about the notorious worm of 2010 believed to have been jointly created by the U.S. and Israeli governments to sabotage Iran's nuclear program. Stuxnet relied on several vulnerabilities to infect and spread, including a print spooler bug.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts