Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Business Intelligence Sales & Marketing More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Microsoft/Windows
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
What Do Microsoft
What Do Microsoft's Extra Patches Mean for IT Admins?

By Jennifer LeClaire
February 12, 2014 10:38AM

Bookmark and Share
"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site," said Craig Young, a security researcher at Tripwire, on Microsoft's Patch Tuesday. "Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today."
 



Microsoft on Tuesday released 31 security bulletins, including two last-minute critical fixes. Overall, four of the bulletins are critical. That makes it a busy month for IT administrators who were only expecting the standard flow.

We caught up with Ross Barrett, a senior manager of security engineering at Rapid7, to get his take on the flood. He told us it looked like Microsoft would continue the 2014 trend of keeping Patch Tuesday relatively light. There were only five advisories this month, two critical, three important. The key word is "were," until the last minute critical updates.

"Due to the criticality of it, they bent their schedule in favor of customer security to get the patch out sooner," Barrett said. "The added OS patch is a variant of one of the IE patches, and shares a CVE [common vulnerability and exposure]. Reaction to this could fall into one of two camps, either fear that something is being rushed out the door, or relief that we don't have to wait another month for an IE roll-up, which is a really long time on the Internet."

Beware Watering-Hole Attacks

IE takes the lead with more than 20 critical vulnerabilities this month and is defiantly the most critical issue to get patched, said Lamar Bailey, director of security research at Tripwire.

"Given the late additions to this patch cycle, companies will want to make sure to take a careful look and test carefully before rolling it out to everyone," Bailey told us. "The VBScript update is the next critical but this specific patch is for everyone without IE9. If you are using IE9 you will get the patch in your IE update."

Bailey's colleague Craig Young, a security researcher at the firm, told us with more than 20 CVEs in this month's IE update, there's plenty of opportunities for drive-by downloads via watering-hole attacks.

"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site. Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today," he said. "Some users may be in for a surprise this month if they didn't prepare for the impending deprecation of MD5 as a suitable hashing algorithm for their certificates. Microsoft announced this back in August, so users running into problems now have no one but themselves to blame per advisory 2862973."

What's Most Interesting

Finally, Tyler Reguly, manager of security research at Tripwire, told us he's sure a lot of people will call attention to the Forefront Protection for Exchange (MS14-008) patch this month. However, he said when Microsoft, the people with the source code, tells security researchers they can't trigger the vulnerability in a meaningful way, he takes the company at its word.

"The most interesting thing released this month is a patch for Slowloris in .NET. This attack drew attention when RSnake wrote about it five years ago but updates to his research showed reports of the concept going all the way back to 2005," he said. "While no one discussed ASP.NET in that work, it's interesting to see a 9-year-old concept patched because it leads you to ask....Why now?"
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Microsoft/Windows
1.   Lenovo Still in Small Windows Tablets
2.   How Chrome Eats Your Battery Life
3.   Are These Layoffs Best for Microsoft?
4.   Microsoft Axes Android Phones
5.   Microsoft Will Lay Off 18,000 Workers


advertisement
Review: Microsoft's Surface Pro 3
Is it a tablet and laptop replacement?
Average Rating:
Bing Lets Europeans Be 'Forgotten'
Following in Google's footsteps.
Average Rating:
Microsoft Announces $199 Laptop
Taking on Google's Chromebooks.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Enterprise Hardware Spotlight
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 
Another Day, Another Internet of Things Consortium Is Born
In the emerging Internet of Things, zillions of devices will be talking to each other. Samsung, Intel and Dell just formed a consortium to ensure each thing can understand what others are saying.
 

Mobile Technology Spotlight
Apple Patent for Smart Watch Comes to Light
Does a new smart watch patent issued to Apple provide a preview of the expected wearable from the tech giant? Some Apple-watchers are parsing the patent for signs of the coming product.
 
Will iPhone 6 Cannibalize Apple's Tablet Sales?
Could Apple’s iPhone 6 -- it’s so-called super-size phone due to hit store shelves this fall -- come back to haunt the smartphone maker? Some observers say yes; others say preposterous.
 
Axed Nokia X Phones Suffered from Lack of Identity
So long, Nokia X, we hardly knew you. The Nokia X phones Microsoft discontinued blend two rival operating systems, but leave out the best of each. As a result, the devices didn't become a runaway hit.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Business Intelligence | Sales & Marketing | Contact Centers | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.