Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home CRM Systems Customer Service Business Intelligence Sales & Marketing More Topics...
Vblock™ Systems:
Advanced converged infrastructure
increases productivity & lowers costs.

www.vce.com
Network Security
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
What Do Microsoft
What Do Microsoft's Extra Patches Mean for IT Admins?

By Jennifer LeClaire
February 12, 2014 10:38AM

Bookmark and Share
"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site," said Craig Young, a security researcher at Tripwire, on Microsoft's Patch Tuesday. "Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today."
 


Microsoft on Tuesday released 31 security bulletins, including two last-minute critical fixes. Overall, four of the bulletins are critical. That makes it a busy month for IT administrators who were only expecting the standard flow.

We caught up with Ross Barrett, a senior manager of security engineering at Rapid7, to get his take on the flood. He told us it looked like Microsoft would continue the 2014 trend of keeping Patch Tuesday relatively light. There were only five advisories this month, two critical, three important. The key word is "were," until the last minute critical updates.

"Due to the criticality of it, they bent their schedule in favor of customer security to get the patch out sooner," Barrett said. "The added OS patch is a variant of one of the IE patches, and shares a CVE [common vulnerability and exposure]. Reaction to this could fall into one of two camps, either fear that something is being rushed out the door, or relief that we don't have to wait another month for an IE roll-up, which is a really long time on the Internet."

Beware Watering-Hole Attacks

IE takes the lead with more than 20 critical vulnerabilities this month and is defiantly the most critical issue to get patched, said Lamar Bailey, director of security research at Tripwire.

"Given the late additions to this patch cycle, companies will want to make sure to take a careful look and test carefully before rolling it out to everyone," Bailey told us. "The VBScript update is the next critical but this specific patch is for everyone without IE9. If you are using IE9 you will get the patch in your IE update."

Bailey's colleague Craig Young, a security researcher at the firm, told us with more than 20 CVEs in this month's IE update, there's plenty of opportunities for drive-by downloads via watering-hole attacks.

"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site. Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today," he said. "Some users may be in for a surprise this month if they didn't prepare for the impending deprecation of MD5 as a suitable hashing algorithm for their certificates. Microsoft announced this back in August, so users running into problems now have no one but themselves to blame per advisory 2862973."

What's Most Interesting

Finally, Tyler Reguly, manager of security research at Tripwire, told us he's sure a lot of people will call attention to the Forefront Protection for Exchange (MS14-008) patch this month. However, he said when Microsoft, the people with the source code, tells security researchers they can't trigger the vulnerability in a meaningful way, he takes the company at its word.

"The most interesting thing released this month is a patch for Slowloris in .NET. This attack drew attention when RSnake wrote about it five years ago but updates to his research showed reports of the concept going all the way back to 2005," he said. "While no one discussed ASP.NET in that work, it's interesting to see a 9-year-old concept patched because it leads you to ask....Why now?"
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Network Security
1.   Verizon Report Exposes Cyberthreats
2.   How Are Web Sites Post-Heartbleed?
3.   White House Updating Privacy Policy
4.   Target Hackers May Be Tough To Find
5.   Heartbleed Exploit Could Cost Millions


advertisement
How Are Web Sites Post-Heartbleed?
Questions on open source, security.
Average Rating:
Heartbleed Exploit Could Cost Millions
But it could have been prevented.
Average Rating:
Michaels: Nearly 3M Cards Breached
But the hack has been contained.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 
Where Do Web Sites Stand, Post-Heartbleed?
A security firm says the vast majority of Web sites have patched themselves to protect against the Heartbleed bug, but now there are questions raised on the reliability of open-source programs.
 
White House Updating Online Privacy Policy
A new Obama administration privacy policy explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites, saying much is in the public domain.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Business Intelligence | Sales & Marketing | Contact Centers | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.