HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 12 MINUTES AGO.
You are here: Home / Data Security / Light Patch Tuesday, But Still Critical
Light Patch Tuesday, But Still Carries Critical Issues
Light Patch Tuesday, But Still Carries Critical Issues
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
JANUARY
11
2012

Microsoft on Tuesday released seven security bulletins. One is rated critical and the others are classified as important. But even the important bulletins are vital for IT admins to address swiftly.

"Although only rated important, we actually picked the Assembly Execution Vulnerability as the most severe issue this month," said Joshua Talbot, security intelligence manager for Symantec Security Response. "The vulnerability is due to an oversight that allows an attacker to run malware as soon as a user opens a Word or PowerPoint file. E-mail attachments will probably be the most common attack method in which this vulnerability is exploited."

Top Deployment Priority

Historically, January has a been a light month for Microsoft patches and, so far, this year is no different, noted Andrew Storms, director of security operations at nCircle. As he sees it, the Windows Media Player bulletin for Windows Vista and XP should be the top deployment priority for everyone.

"The most significant bug in the bulletin can be exploited via a drive-by attacks, and that's always a major concern," Storms said. "This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit."

The January release also includes an expected fix for the Beast SSL attack that was pulled from the December patch at the last minute because of third-party vendor interaction issues.

"It's interesting to note that despite all of the hype over the Beast, attacks have simply never materialized and the issue has retained its 'important' classification from Microsoft," said Paul Henry, security and forensic analyst at Lumension. "Overall, we saw a reduction in the number of critical issues from Microsoft in 2011. To that end, we can anticipate Microsoft will bolster defense-in-depth efforts and will likely increase the numbers of important issues like privilege escalation."

Critical Issues

What about the critical vulnerability? Similar to the Assembly Execution Vulnerability, the MIDI Remote Code Execution Vulnerability is file-based and could potentially be used in e-mail attacks as well, Talbot said. The difference, in his eyes, is that it is a memory corruption issue and would be a bit more difficult to exploit.

"This is also a good time to remind everyone about the critical out-of-band patch Microsoft issued late last month," Talbot concluded. "Because it's likely many people were out on vacation, it may have slipped through the cracks. However, it's very important that the MS11-100 bulletin gets addressed as soon as possible."

Finally, the advance notification for January included a new category called 'Security Feature Bypass'. Storms said this somewhat mysterious category turned out to be related to binary code compiled with one version of the Microsoft C++ .NET compiler that did not have all the security protections enabled.

"This seems like it could be a cause for concern, but as of yet," he concluded, "there isn't any evidence that shows attackers are taking advantage of the loophole."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
UCS Invicta: Integrated Flash Why wait for the future? Unlock the potential of your applications and create new business opportunities today with UCS Invicta Series Solid State Systems. Take advantage of the power of flash technology. See how it can help accelerate IT, eliminate data center bottlenecks, and deliver the peak application performance and predictability your users demand. Click here to learn more.
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

ENTERPRISE HARDWARE SPOTLIGHT
Making a major change to its usually staid design philosophy, HP unveiled an all-in-one PC with built-in projector and surface-enabled touch, designed to make 3D scanning and printing easy.
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.