Microsoft kicks off 2013 with clutch of critical Windows updates
"But it's more like a 'watering hole,' where [an attacker] puts something malicious in the spooler and the next user who comes along gets infected," said Storm.
Microsoft security engineers Ali Rahbar and Jonathan Ness called the attack vector for the MS13-001 vulnerability "a little different than previous spooler service vulnerabilities" when they explained why they devoted a blog to it.
Rahbar and Ness said that the bug could not be triggered unless a Windows 7 or Server 2008 R2 customer had "third-party software installed on the client that enumerates print jobs differently than built-in Windows components."
They did not name names -- something Microsoft's always hesitant to do, said Miller -- but were talking about proprietary printer drivers and utilities included with printers sold by the likes of Hewlett-Packard, Epson and others.
"Essentially those DVDs you get with the printer are what will trigger this," said Storms. The flaw, however, is not in that software, but in Microsoft's.
Other updates released Tuesday included one that quashed four bugs in the .Net development framework, which is bundled with every edition of Windows; another in Windows' kernel-mode driver that affected Vista, Windows 7, Windows 8 and Windows RT; and others that addressed vulnerabilities in System Center Operations Manager and the Open Data (OData) protocol.
Today's patches didn't end with Microsoft. Several other vendors also delivered updates. Adobe, for example, again patched Flash Player, the media software baked into Google's Chrome and Microsoft's IE10. And Mozilla pushed out Firefox 18, the newest edition of its every-six-weeks browser.
Among the torrent of patches, one not offered today was for the IE6, IE7 and IE8 zero-day bug that hackers have been exploiting since at least Dec. 7.
Neither Storms nor Miller thought Microsoft could wait until the next round of scheduled updates on Feb. 12, five weeks from today, to patch the IE bug -- not with reports of attacks coming from additional compromised websites, as well as claims by Exodus Intelligence that it's crafted exploits that sidestep both workarounds Microsoft has urged customers to use until a patch is provided.
"I wouldn't be surprised if they go 'out-of-band,'" said Storms, using the term for an emergency update. "They won't want to wait for five weeks, and there's enough pressure on them now to work on an out-of-band."
"They will go out of band on this," asserted Miller. "Windows XP users can't get to IE9, and there are a lot still running XP. I think they'll [have a patch] as soon as next week, and no later than two weeks."
IE9 and IE10 do not contain the bug, which according to Symantec, was used by the Elderwood group for cyber espionage. But because IE9 won't run on Windows XP, those customers are stuck with a vulnerable browser. Data from Web analytics company Net Applications puts XP's online usage share at 39% in December, meaning nearly four out of every 10 personal computer users runs the aged OS.
January's security updates can be downloaded and installed through the Microsoft Update and Windows Update services, as well as via WSUS (Windows Server Update Services), the de facto patching mechanism for businesses.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts