Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.
Microsoft/Windows
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
What Do Microsoft
What Do Microsoft's Extra Patches Mean for IT Admins?

By Jennifer LeClaire
February 12, 2014 10:38AM

Bookmark and Share
"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site," said Craig Young, a security researcher at Tripwire, on Microsoft's Patch Tuesday. "Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today."
 


Microsoft on Tuesday released 31 security bulletins, including two last-minute critical fixes. Overall, four of the bulletins are critical. That makes it a busy month for IT administrators who were only expecting the standard flow.

We caught up with Ross Barrett, a senior manager of security engineering at Rapid7, to get his take on the flood. He told us it looked like Microsoft would continue the 2014 trend of keeping Patch Tuesday relatively light. There were only five advisories this month, two critical, three important. The key word is "were," until the last minute critical updates.

"Due to the criticality of it, they bent their schedule in favor of customer security to get the patch out sooner," Barrett said. "The added OS patch is a variant of one of the IE patches, and shares a CVE [common vulnerability and exposure]. Reaction to this could fall into one of two camps, either fear that something is being rushed out the door, or relief that we don't have to wait another month for an IE roll-up, which is a really long time on the Internet."

Beware Watering-Hole Attacks

IE takes the lead with more than 20 critical vulnerabilities this month and is defiantly the most critical issue to get patched, said Lamar Bailey, director of security research at Tripwire.

"Given the late additions to this patch cycle, companies will want to make sure to take a careful look and test carefully before rolling it out to everyone," Bailey told us. "The VBScript update is the next critical but this specific patch is for everyone without IE9. If you are using IE9 you will get the patch in your IE update."

Bailey's colleague Craig Young, a security researcher at the firm, told us with more than 20 CVEs in this month's IE update, there's plenty of opportunities for drive-by downloads via watering-hole attacks.

"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site. Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today," he said. "Some users may be in for a surprise this month if they didn't prepare for the impending deprecation of MD5 as a suitable hashing algorithm for their certificates. Microsoft announced this back in August, so users running into problems now have no one but themselves to blame per advisory 2862973."

What's Most Interesting

Finally, Tyler Reguly, manager of security research at Tripwire, told us he's sure a lot of people will call attention to the Forefront Protection for Exchange (MS14-008) patch this month. However, he said when Microsoft, the people with the source code, tells security researchers they can't trigger the vulnerability in a meaningful way, he takes the company at its word.

"The most interesting thing released this month is a patch for Slowloris in .NET. This attack drew attention when RSnake wrote about it five years ago but updates to his research showed reports of the concept going all the way back to 2005," he said. "While no one discussed ASP.NET in that work, it's interesting to see a 9-year-old concept patched because it leads you to ask....Why now?"
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Microsoft/Windows
1.   BBM Now Available on Windows Phone
2.   Microsoft Spreads Cortana Abroad
3.   China Puts Microsoft Under the Lens
4.   Win Phone 8.1 Update Already on Way
5.   Yammer Moved to Office 365


advertisement
China Puts Microsoft Under the Lens
Official anti-monopoly probe launched.
Average Rating:
Microsoft CEO Sees 'Bold' Plan Ahead
With unified Windows for all platforms.
Average Rating:
Design Central to Microsoft Future
New ethos a break from functional past.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.