HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 4 MINUTES AGO.
You are here: Home / Computing / Extra Fixes Issued for Patch Tuesday
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
What Do Microsoft's Extra Patches Mean for IT Admins?
What Do Microsoft's Extra Patches Mean for IT Admins?
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
FEBRUARY
12
2014

Microsoft on Tuesday released 31 security bulletins, including two last-minute critical fixes. Overall, four of the bulletins are critical. That makes it a busy month for IT administrators who were only expecting the standard flow.

We caught up with Ross Barrett, a senior manager of security engineering at Rapid7, to get his take on the flood. He told us it looked like Microsoft would continue the 2014 trend of keeping Patch Tuesday relatively light. There were only five advisories this month, two critical, three important. The key word is "were," until the last minute critical updates.

"Due to the criticality of it, they bent their schedule in favor of customer security to get the patch out sooner," Barrett said. "The added OS patch is a variant of one of the IE patches, and shares a CVE [common vulnerability and exposure]. Reaction to this could fall into one of two camps, either fear that something is being rushed out the door, or relief that we don't have to wait another month for an IE roll-up, which is a really long time on the Internet."

Beware Watering-Hole Attacks

IE takes the lead with more than 20 critical vulnerabilities this month and is defiantly the most critical issue to get patched, said Lamar Bailey, director of security research at Tripwire.

"Given the late additions to this patch cycle, companies will want to make sure to take a careful look and test carefully before rolling it out to everyone," Bailey told us. "The VBScript update is the next critical but this specific patch is for everyone without IE9. If you are using IE9 you will get the patch in your IE update."

Bailey's colleague Craig Young, a security researcher at the firm, told us with more than 20 CVEs in this month's IE update, there's plenty of opportunities for drive-by downloads via watering-hole attacks.

"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site. Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today," he said. "Some users may be in for a surprise this month if they didn't prepare for the impending deprecation of MD5 as a suitable hashing algorithm for their certificates. Microsoft announced this back in August, so users running into problems now have no one but themselves to blame per advisory 2862973."

What's Most Interesting

Finally, Tyler Reguly, manager of security research at Tripwire, told us he's sure a lot of people will call attention to the Forefront Protection for Exchange (MS14-008) patch this month. However, he said when Microsoft, the people with the source code, tells security researchers they can't trigger the vulnerability in a meaningful way, he takes the company at its word.

"The most interesting thing released this month is a patch for Slowloris in .NET. This attack drew attention when RSnake wrote about it five years ago but updates to his research showed reports of the concept going all the way back to 2005," he said. "While no one discussed ASP.NET in that work, it's interesting to see a 9-year-old concept patched because it leads you to ask....Why now?"

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
ISACA® offers a global community of more than 115,000 IS/IT constituents in over 180 countries. We develop and deliver industry-leading certifications, education, research and business frameworks. We equip individuals to be leaders in the fast-changing world of information systems and IT - Learn More>
MORE IN COMPUTING
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Microsoft has some bitter rivals in the technology industry, but when it comes to thwarting government intrusion on customer privacy the software giant has plenty in common with its rivals.

ENTERPRISE HARDWARE SPOTLIGHT
Almost half of consumer, industry and life sciences manufacturers are expected to be using 3D printers within three years and now 3D printing services are aiming to help companies experiment.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.