Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Data Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Light Patch Tuesday, But Still Carries Critical Issues
Light Patch Tuesday, But Still Carries Critical Issues

By Jennifer LeClaire
January 11, 2012 10:03AM

Bookmark and Share
"This is also a good time to remind everyone about the critical out-of-band patch Microsoft issued late last month," said Joshua Talbot, security intelligence manager for Symantec Security Response, about Patch Tuesday "Because it's likely many people were out on vacation, it may have slipped through the cracks," he said of the critical Microsoft Patch.
 


Microsoft on Tuesday released seven security bulletins. One is rated critical and the others are classified as important. But even the important bulletins are vital for IT admins to address swiftly.

"Although only rated important, we actually picked the Assembly Execution Vulnerability as the most severe issue this month," said Joshua Talbot, security intelligence manager for Symantec Security Response. "The vulnerability is due to an oversight that allows an attacker to run malware as soon as a user opens a Word or PowerPoint file. E-mail attachments will probably be the most common attack method in which this vulnerability is exploited."

Top Deployment Priority

Historically, January has a been a light month for Microsoft patches and, so far, this year is no different, noted Andrew Storms, director of security operations at nCircle. As he sees it, the Windows Media Player bulletin for Windows Vista and XP should be the top deployment priority for everyone.

"The most significant bug in the bulletin can be exploited via a drive-by attacks, and that's always a major concern," Storms said. "This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit."

The January release also includes an expected fix for the Beast SSL attack that was pulled from the December patch at the last minute because of third-party vendor interaction issues.

"It's interesting to note that despite all of the hype over the Beast, attacks have simply never materialized and the issue has retained its 'important' classification from Microsoft," said Paul Henry, security and forensic analyst at Lumension. "Overall, we saw a reduction in the number of critical issues from Microsoft in 2011. To that end, we can anticipate Microsoft will bolster defense-in-depth efforts and will likely increase the numbers of important issues like privilege escalation."

Critical Issues

What about the critical vulnerability? Similar to the Assembly Execution Vulnerability, the MIDI Remote Code Execution Vulnerability is file-based and could potentially be used in e-mail attacks as well, Talbot said. The difference, in his eyes, is that it is a memory corruption issue and would be a bit more difficult to exploit.

"This is also a good time to remind everyone about the critical out-of-band patch Microsoft issued late last month," Talbot concluded. "Because it's likely many people were out on vacation, it may have slipped through the cracks. However, it's very important that the MS11-100 bulletin gets addressed as soon as possible."

Finally, the advance notification for January included a new category called 'Security Feature Bypass'. Storms said this somewhat mysterious category turned out to be related to binary code compiled with one version of the Microsoft C++ .NET compiler that did not have all the security protections enabled.

"This seems like it could be a cause for concern, but as of yet," he concluded, "there isn't any evidence that shows attackers are taking advantage of the loophole."
 

Tell Us What You Think
Comment:

Name:





 Data Security
1.   Tor Working To Fix Security Exploit
2.   Protect Yourself from Identity Theft
3.   Hackers Breached StubHub Accounts
4.   Juniper DDoS for High-IQ Networks
5.   Google Hacker Team to Hunt Bugs


advertisement
Protect Yourself from Identity Theft
Even if your data was compromised.
Average Rating:
Tor Working To Fix Security Exploit
Bug reportedly reveals ID of users
Average Rating:
Gartner Rates IT Security Companies
IBM, HP, McAfee, Splunk ranked well.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 
Dropbox for Business Beefs Up Security
Dropbox is upping its game for business users. The cloud-based storage and sharing company has rolled out new security, search and other features to boost its appeal for businesses.
 

Enterprise Hardware Spotlight
Watson Gets His First Customer Service Gig
Since appearing on Jeopardy, IBM's Watson supercomputer has been making a living using his super-intelligent knowledge base for business verticals. Now, Watson's been hired for his first customer service job.
 
Tablet Giants Apple and Samsung Feel the Heat
When a company saturates its home market with a once-hot product, expect it to pump up efforts elsewhere. Apple, for its part, is now pushing iPads to big corporations and the enterprise market.
 
Microsoft Makes Design Central to Its Future
Over the last four years, Microsoft has doubled the number of designers it employs, putting a priority on fashioning devices that work around people's lives -- and that are attractive and cool.
 

Mobile Technology Spotlight
Stanford Researchers Report Battery Breakthrough
Stanford researchers have found a way to use lithium in a battery's anode, a breakthrough that could triple capacity and has been described as the "holy grail of battery science."
 
Samsung Postpones Launch of Tizen Phone
The possibility that the Tizen operating system can survive is dropping. So the scheduled third-quarter launch in Russia of the Samsung Z smartphone, which is designed for the mobile OS, is being postponed.
 
Verizon Plans Throttling for 'Unlimited' Bandwidth Hogs
In what could be an opportunity for competing wireless carriers, Verizon is throttling data speeds on unlimited 4G plans because of more consumer demand for high-speed data networks.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.