Patch Tuesday brings crucial IE fix
Microsoft issued four critical security bulletins and four additional important bulletins covering IE, Windows and Microsoft Office
IDG News Service - As anticipated, the latest round of Microsoft's Patch Tuesday monthly release of security fixes addresses a widely known Internet Explorer (IE) vulnerability already being exploited by malicious hackers.
The critical IE bulletin covers one publicly disclosed vulnerability and nine vulnerabilities not yet known by the public. The other three critical bulletins address flaws in the Windows OS. Three of the bulletins marked as important address issues with Microsoft Office, and the fourth remedies a problem in Silverlight.
Administrators should apply the patch for the IE vulnerabilities first, advised Wolfgang Kandek, chief technology officer of IT security firm Qualys.
This month's collection also marks the 10th anniversary of Microsoft's Patch Tuesday, which the company started in October 2003 in order to bundle security patches into monthly release cycles, which would allow system administrators to apply them all at the same time, rather than deal with each patch individually.
Although holding on to crucial patches for up to 30 days can be potentially problematic in terms of security -- at least for those patches that address publicly known vulnerabilities -- the monthly release cycle has been beneficial for the industry, in that it brings order to an otherwise unruly process of staying ahead of those who exploit vulnerabilities for nefarious purposes, Kandek said.
"Our perspective has certainly evolved from 10 years ago when Patch Tuesday was started. Back then vulnerabilities were clear cut and straightforward to understand. Today the amount of complexity that goes into the detection and remediation process is truly impressive," Kandek later added in an e-mail statement.
The IE public vulnerability, works by exploiting how IE accesses computer memory, allowing a maliciously designed Web page to gain user privileges on a computer. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights," a Microsoft advisory warned.
When the vulnerability was made public last month, malicious hackers quickly put it to use. An exploit based on the vulnerability was added to the popular penetration testing framework Metasploit, where it could be used on its own, or as one in a chain of vulnerabilities designed to gain illicit access to computers. Most of the attacks targeted versions 8 and 9 of IE, though all currently supported versions of the browser could be affected.
The IE vulnerability might have been severe enough to warrant Microsoft issuing an out-of-band patch before this month's Patch Tuesday. Instead, the company issued instructions on how to temporarily fix the problem and scheduled the correction for this month's Patch Tuesday. The move was a wise one, Kandek said. "Every time you go out of band, it makes the work of the IT administrators harder, because they have to react to it and push out patches that they were not prepared for," he said.
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts