Microsoft patches IE with record-setting updates to prep browser for Pwn2Own
IE9, IE10 face hackers in three weeks when $175,000 is up for grabs at annual contest
Computerworld - Microsoft this week patched 14 vulnerabilities in Internet Explorer (IE), preparing the browser for its time as a target early next month at the annual Pwn2Own hacking contest.
On Tuesday, Microsoft patched 57 vulnerabilities, including 14 affecting IE that were delivered in two separate security updates. One of those updates, MS13-009, fixed 13 flaws, a dozen of them judged "critical," the company's most serious threat rating. The second update, MS13-010, patched a single vulnerability. That bug was also pegged critical.
IE9 and IE10 will face Pwn2Own hackers starting March 6 at the CanSecWest security conference in Vancouver, British Columbia. The first researcher to successfully demonstrate an exploit of one or more previously-unknown vulnerabilities in IE9 on Windows 7 will take home a $75,000 cash prize. The first who takes down IE10, Microsoft's newest browser, running on Windows 8, will earn an even $100,000.
Eleven of the 13 vulnerabilities patched in MS13-009 were rated critical for IE9 on Windows 7, while four were tagged the same for IE10 on Windows 8. The one bug in MS13-010 was labeled critical for both browsers.
Microsoft said that all the critical vulnerabilities could be exploited by attackers to hijack a Windows PC. If they had gone unpatched, researchers would have been able to use them at Pwn2Own.
Andrew Storms, director of security operations at nCircle Security, noted the large number of IE vulnerabilities patched this week -- the most in at least six years. "It's a big clearing of the backlog," said Storms.
Another unusual aspect of the IE patches was that they came in more than one update, which Microsoft designates as "bulletins." This was the first month in Storms' memory that Microsoft had issued two IE bulletins simultaneously. Typically, it bundles all patches into one update.
Storms suspected the reason stemmed from Microsoft's internal organization. "I'm guessing the Office team probably created the VML patch," he said, referring to MS13-010, the one-patch update that fixed a flaw in Vector Markup Language (VML).
While MS13-010 patched IE6, IE7, IE8, IE9 and IE10 to fix the VML bug, the image format originated with Microsoft's Office suite, where it remains in wide use. It's supported by IE so that websites and Web apps using the format can be properly rendered. Microsoft has pushed Web developers to use SVG (Scalable Vector Graphics) instead, and has officially made VML obsolete -- although still supported in legacy modes -- in IE10.
If past practice holds, other browser makers will also update their applications before Pwn2Own. Mozilla, for instance, will ship Firefox 19 next Tuesday, Feb. 19. And while Google does not adhere to a regular update schedule for Chrome -- unlike Microsoft and Mozilla -- it will probably patch before the contest as well.
Pwn2Own will award prizes of $100,000 to the first researcher to crack Chrome on Windows 7, and $60,000 to the first to hack Firefox on that same OS.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts