Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
You are here: Home / Microsoft/Windows / Extra Fixes Issued for Patch Tuesday
DDoS Protection Powered By Verisign
What Do Microsoft's Extra Patches Mean for IT Admins?
What Do Microsoft's Extra Patches Mean for IT Admins?
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
FEBRUARY
12
2014


Microsoft on Tuesday released 31 security bulletins, including two last-minute critical fixes. Overall, four of the bulletins are critical. That makes it a busy month for IT administrators who were only expecting the standard flow.

We caught up with Ross Barrett, a senior manager of security engineering at Rapid7, to get his take on the flood. He told us it looked like Microsoft would continue the 2014 trend of keeping Patch Tuesday relatively light. There were only five advisories this month, two critical, three important. The key word is "were," until the last minute critical updates.

"Due to the criticality of it, they bent their schedule in favor of customer security to get the patch out sooner," Barrett said. "The added OS patch is a variant of one of the IE patches, and shares a CVE [common vulnerability and exposure]. Reaction to this could fall into one of two camps, either fear that something is being rushed out the door, or relief that we don't have to wait another month for an IE roll-up, which is a really long time on the Internet."

Beware Watering-Hole Attacks

IE takes the lead with more than 20 critical vulnerabilities this month and is defiantly the most critical issue to get patched, said Lamar Bailey, director of security research at Tripwire.

"Given the late additions to this patch cycle, companies will want to make sure to take a careful look and test carefully before rolling it out to everyone," Bailey told us. "The VBScript update is the next critical but this specific patch is for everyone without IE9. If you are using IE9 you will get the patch in your IE update."

Bailey's colleague Craig Young, a security researcher at the firm, told us with more than 20 CVEs in this month's IE update, there's plenty of opportunities for drive-by downloads via watering-hole attacks.

"The range of problems fixed this month can be combined to gain complete administrative access by tricking a user into visiting a malicious site. Without any doubt, attacks in the wild will continue and expand to the other vulnerabilities being fixed today," he said. "Some users may be in for a surprise this month if they didn't prepare for the impending deprecation of MD5 as a suitable hashing algorithm for their certificates. Microsoft announced this back in August, so users running into problems now have no one but themselves to blame per advisory 2862973."

What's Most Interesting

Finally, Tyler Reguly, manager of security research at Tripwire, told us he's sure a lot of people will call attention to the Forefront Protection for Exchange (MS14-008) patch this month. However, he said when Microsoft, the people with the source code, tells security researchers they can't trigger the vulnerability in a meaningful way, he takes the company at its word.

"The most interesting thing released this month is a patch for Slowloris in .NET. This attack drew attention when RSnake wrote about it five years ago but updates to his research showed reports of the concept going all the way back to 2005," he said. "While no one discussed ASP.NET in that work, it's interesting to see a 9-year-old concept patched because it leads you to ask....Why now?"

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN MICROSOFT/WINDOWS
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Are Government Spies Tipping Off Tor?
Less than a month ago, tech news headlines heralded a Tor Project breach. Now, some are saying that government spies are sharing information with Tor to help it prevent future breaches.
 
Backoff Malware Hits 1,000+ Businesses, Likely More
More than 1,000 businesses across the U.S. might have been affected by Backoff, a new kind of point-of-sale (PoS) malware, according to the Department of Homeland Security.
 
PlayStation Network Back Online After Attack
Sony’s PlayStation and Entertainment Network are back online after a distributed denial of service (DDoS) attack crashed the systems on Sunday. But Sony says no personal info was accessed.
 

Enterprise Hardware Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Mobile Technology Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Verizon Hops on the Voice-Over-LTE Bandwagon
Wireless provider Verizon is gearing up for a nationwide launch of its Voice-over-LTE service over the next several weeks, promising clearer and crisper phone calls and a Skype-like video service.
 
Smartphone 'Kill Switch' Law in California; Will Other States Follow?
California’s new law -- signed by Gov. Jerry Brown on Monday -- aimed at deterring cellphone theft could mean most mobile phones sold in the U.S. will soon include similar “kill-switch” tech.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.