Microsoft patches IE with record-setting updates to prep browser for Pwn2Own
IE9, IE10 face hackers in three weeks when $175,000 is up for grabs at annual contest
Computerworld - Microsoft this week patched 14 vulnerabilities in Internet Explorer (IE), preparing the browser for its time as a target early next month at the annual Pwn2Own hacking contest.
On Tuesday, Microsoft patched 57 vulnerabilities, including 14 affecting IE that were delivered in two separate security updates. One of those updates, MS13-009, fixed 13 flaws, a dozen of them judged "critical," the company's most serious threat rating. The second update, MS13-010, patched a single vulnerability. That bug was also pegged critical.
IE9 and IE10 will face Pwn2Own hackers starting March 6 at the CanSecWest security conference in Vancouver, British Columbia. The first researcher to successfully demonstrate an exploit of one or more previously-unknown vulnerabilities in IE9 on Windows 7 will take home a $75,000 cash prize. The first who takes down IE10, Microsoft's newest browser, running on Windows 8, will earn an even $100,000.
Eleven of the 13 vulnerabilities patched in MS13-009 were rated critical for IE9 on Windows 7, while four were tagged the same for IE10 on Windows 8. The one bug in MS13-010 was labeled critical for both browsers.
Microsoft said that all the critical vulnerabilities could be exploited by attackers to hijack a Windows PC. If they had gone unpatched, researchers would have been able to use them at Pwn2Own.
Andrew Storms, director of security operations at nCircle Security, noted the large number of IE vulnerabilities patched this week -- the most in at least six years. "It's a big clearing of the backlog," said Storms.
Another unusual aspect of the IE patches was that they came in more than one update, which Microsoft designates as "bulletins." This was the first month in Storms' memory that Microsoft had issued two IE bulletins simultaneously. Typically, it bundles all patches into one update.
Storms suspected the reason stemmed from Microsoft's internal organization. "I'm guessing the Office team probably created the VML patch," he said, referring to MS13-010, the one-patch update that fixed a flaw in Vector Markup Language (VML).
While MS13-010 patched IE6, IE7, IE8, IE9 and IE10 to fix the VML bug, the image format originated with Microsoft's Office suite, where it remains in wide use. It's supported by IE so that websites and Web apps using the format can be properly rendered. Microsoft has pushed Web developers to use SVG (Scalable Vector Graphics) instead, and has officially made VML obsolete -- although still supported in legacy modes -- in IE10.
If past practice holds, other browser makers will also update their applications before Pwn2Own. Mozilla, for instance, will ship Firefox 19 next Tuesday, Feb. 19. And while Google does not adhere to a regular update schedule for Chrome -- unlike Microsoft and Mozilla -- it will probably patch before the contest as well.
Pwn2Own will award prizes of $100,000 to the first researcher to crack Chrome on Windows 7, and $60,000 to the first to hack Firefox on that same OS.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Accelerating Network Convergence in Virtualized and Cloud Data Centers Adopting a converged networking strategy enables organizations to traffic server and storage I/O workloads on consolidated data throughput channels. Intelligent software helps optimize...
- Omnichannel: From Buzzword to Strategy Customers demand a seamless experience across channels, especially mobile. Read this whitepaper for a research-based framework for using omnichannel for higher customer engagement.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts