HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 8 MINUTES AGO.
You are here: Home / Data Security / Light Patch Tuesday This Week for MS
Barium Ferrite (BaFe):
Higher Capacity, Superior Performance, Longer Archival Life
www.thefutureoftape.com
Light Patch Tuesday Sets Stage for April Showers
Light Patch Tuesday Sets Stage for April Showers
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MARCH
09
2011

In a relatively light cycle, Microsoft has issued three security bulletins to address four vulnerabilities. Two bulletins are for Windows and one is for Office. Redmond rated only one critical.

Joshua Talbot, security intelligence manager at Symantec Security Response, said the lone critical issue this month -- the DVR-MS vulnerability -- will be somewhat trivial for attackers to exploit.

"It also allows attackers to skip a few of the traditional steps needed to get malicious code to execute on a targeted computer," Talbot said. "This is because when processing DVR-MS files, Windows Media Player and Media Center use data in these files themselves to determine what code in memory gets executed. This allows an attacker to jump directly to executing malicious code."

Don't Take It Too Lightly

Paul Henry, forensic and security analyst at Lumension, warns IT admins not to be fooled by the light patch load. As he sees it, there's still more than enough work to go around. Despite issuing just three bulletins, the implications are serious. That's because all the patches aim at issues that allow remote code execution.

Henry said enterprises using the Remote Desktop Client, should make MS11-017 the top priority, followed by MS11-015 and finally MS11-016. Enterprises that are not using Remote Desktop Client but are regularly sending and receiving large media files should focus on MS11-015 first.

"Microsoft may have cleaned up a lot of loose ends with the release of Windows 7 and Windows Server 2008 R2 Service Pack 1 last month, leaving little to address this Patch Tuesday," Henry noted. "That being said, the patches released today did not address the recently disclosed MHTML issues and we expect a resolution in April's patch release."

April Showers?

Andrew Storms, director of Security at nCircle, welcomes what he calls a "lull" in security news from Microsoft, especially considering the steady flow of high profile vulnerabilities over the past few months.

Storms expects April to bring a shower of patches as part of Microsoft's seasonal high-low months. He also noted that the CanSec West's Pwn2own hacking contest, which is scheduled for later this week, traditionally unearths some interesting Internet Explorer and Windows 7 phone security bugs.

"Microsoft did not include a fix for the MHTML bug that they issued an advisory for in late January. While the March timeframe was probably doable for a release, it's likely that Microsoft hasn't seen much in the way of attacks for this vulnerability, so they felt comfortable keeping the patch on a normal release cycle. Users concerned about this bug can apply the FixIt mitigation tool Microsoft released last month."

Tyler Reguly, technical manager of security research at nCircle, found the contents of the bulletins this month "pretty boring." In fact, he said DLL Preloading is "such a snooze" that it's really not worth talking about anymore. But, he also issued a warning: "Everyone should probably take advantage of this light month of patching because the bulletin release pattern dictates that we'll all be very busy next month."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Barium Ferrite Is The Future Of Tape: Barium Ferrite (BaFe) offers greater capacity, superior performance, and longer archival life compared to legacy metal particle (MP) tape. Click here to learn more.
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Following last week's cyberattack on Sony and a vow by the U.S. to take action, the entire country of North Korea has been "disconnected" from the Internet for more than 9 hours.

ENTERPRISE HARDWARE SPOTLIGHT
Remember the classic BlackBerry that took the cell phone market by storm in its heyday? Well, it’s retro time at the Canadian handset maker as it rolls out the aptly-named BlackBerry Classic.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.