Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
You are here: Home / Enterprise Software / Win 7, IE9 Bring Fewer 2011 Patches
Microsoft Shows Security Improvements with 2011 Patch Tuesdays
Microsoft Shows Security Improvements with 2011 Patch Tuesdays
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
Microsoft on Tuesday issued 13 security bulletins. Only three were rated critical. That's a small reprieve since IT admins expected 14 bulletins -- the fix for the so-called Beast attack did not make it into this release.

December's Patch Tuesday brings Microsoft's total to 99 bulletins in 2011.

Joshua Talbot, security intelligence manager for Symantec Security Response, said the most important patch this month is the TrueType Font Parsing issue, which is the zero-day vulnerability exploited as part of the Duqu targeted attacks.

"The Duqu malware didn't actually incorporate an exploit for this issue in its code, but the vulnerability was used by malicious e-mail attachments to load Duqu onto targeted systems," he explained.

Symantec typically puts Internet Explorer cumulative updates pretty high on its priority list, Talbot added, but this month none of the IE vulnerabilities are particularly high-impact issues.

"They're still important, but we suggest prioritizing quite a few of the other bulletins ahead of them. For example, the Windows Media Player DVR-MS memory corruption issue," Talbot said. "This one looks pretty simple to exploit and can result in a complete system takeover. To make matters worse, [data execution prevention] and [address space layout randomization] only offer limited protection here."

No Out-of-Band Patches in 2011

Andrew Storms, director of security operations at nCircle, noted that it's been a long time since Microsoft pulled a bulletin at the last minute. Microsoft pulled the Beast fix because of a bad interaction with a high-profile vendor.

"This last minute change highlights the extensive testing Microsoft does during the patch releases. A bad patch makes for the worst sort of IT heartburn," Storms said. "I'm sure we'll see the 'Beast' bulletin in the January patch, and waiting a little longer for a fix shouldn't be much of an issue because it's fairly difficult to take advantage of this bug."

Although anything could happen in the next two weeks, Storms pointed out that Microsoft appears to have made it through 2011 without having to issue an out-of-band patch. In fact, he added, the year has been marked by lower severity ratings for all vulnerabilities.

"The new, improved risk mitigation technologies in Windows 7 and IE9 just might make out-of-band Microsoft patches a thing of the past," Storms said, "and that would be the best holiday gift Microsoft could give."

Total Patch Count Declines

Considering the previous years of Microsoft patches, this is not a bad way to end the year, said Paul Henry, a security and forensic analyst and blogger at Lumension. Microsoft released 17 bulletins in the 2010 December Patch Tuesday. Microsoft's total patch count, 99, is also down in 2011, from 106 in 2010.

"Clearly Microsoft has dramatically improved its software processes and this is reflected in the continued decline of vulnerabilities considered critical in the current codebase," Henry said. "The numbers speak volumes on the improvements from Microsoft. In 2006, 70 percent of security patches were critical and in 2011 critical vulnerabilities fell to just 30 percent. In an otherwise volatile threat landscape, this is good news for everyone."

Tell Us What You Think


Simphiwe Mayisela:
Posted: 2011-12-30 @ 1:50am PT

Just when we thought that Microsoft did not release an out-of-band patch, on December 29, 2011, Microsoft released an out-of-band Security Bulletin MS11-100 to address the publicly disclosed denial-of-service issue described in Security Advisory 2659883. The maximum severity level of the bulletin is Critical.

Like Us on FacebookFollow Us on Twitter
© Copyright 2018 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.