Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Windows Security
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
Microsoft Ships Fix for IE Zero-Day Flaw

Microsoft Ships Fix for IE Zero-Day Flaw
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

The highest priority for most organizations on Patch Tuesday will be to deploy Microsoft's IE fix that blocks access to the InfoCard control being exploited in targeted watering-hole attacks. As critical as it is, the IE zero-day fix Microsoft issued on Patch Tuesday appears to be a run of the mill ActiveX memory corruption bug, said one security expert.
 


On Tuesday, Microsoft issued eight security bulletins for its monthly update. The bulletins address 19 vulnerabilities across Microsoft Windows, Internet Explorer and Office. Three of them are critical.

But Redmond didn’t stop there. The software giant also issued three new advisories: Security Advisory 2862152, Security Advisory 2868725 and Security Advisory 2880823. What’s more, two additional advisories were revised: Security Advisory 2755801 and Security Advisory 2854544 to provide updates for Adobe Flash on IE 10 and improve digital certificate handling in Windows.

We caught up with Tyler Reguly, technical manager of security research and development at Tripwire, to get his take on November’s Patch Tuesday. He told us IT pros everywhere will have a little less weight on their shoulders because Microsoft shipped a fix for the current IE zero-day.

“It's important to note, however, that the fix is not in the traditional IE Cumulative Update -- MS13-088 -- but rather in a separate ActiveX fix -- MS13-090,” Reguly said. “Also patched this month is GDI, and while the bulletin wouldn't normally merit a critical rating, the vulnerability exists in a common API call that may be implemented by numerous third-party products. In addition to applying today's patches, keep an eye out for security updates from other vendors that make use of the built-in Windows' graphics libraries.”

Unique Outlook Vulnerability

As Reguly sees it, the more interesting patches this month are for a unique Outlook vulnerability that could allow port-scanning, a Hyper-V vulnerability that could allow Guest OS to Guest OS code execution, and an X.509 issue in schannel.dll that could allow denial of service. While these are unique and interesting vulnerabilities, he said, they pose a lot less risk than typical code execution vulnerabilities.

“It’s interesting that Microsoft released an update for Direct Access that is not considered a ‘security update.' The update resolves a known CVE, but Microsoft didn’t deem it worthy of a bulletin. Generally this implies the update is a functionality change in the software, rather than a pure security fix,” he said.

“While the process makes sense on paper, it makes it much more difficult for administrators to recognize that additional patches that actually resolve vulnerabilities are available for their systems. Regardless of the severity of the issue, not issuing a bulletin decreases security for users of Direct Access everywhere,” he added.

Your Highest Priority

Craig Young, a security researcher at Tripwire, told us the highest priority for most organizations will be to deploy the IE fix that blocks access to the InfoCard control being exploited in targeted watering-hole attacks. As critical as it is, he said, the IE zero-day appears to be a run of the mill ActiveX memory corruption bug.

“MS13-094 can allow remote attackers to craft S/MIME emails for the purpose of running a port scan from a victim system. This is possible because when viewed in Outlook, the S/MIME message could trigger HTTP requests to arbitrary hosts/ports during signature validation,” he explained.

“The attacker can then perform a timing analysis to get an idea of which hosts/ports are accessible from the victim machine. This information can be leveraged in future attacks. Microsoft resolved this issue by limiting the number of S/MIME signers processed,” he said.
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Windows Security
1.   Microsoft Patch Tuesday Stars IE
2.   Kaspersky Looks Inside 'Epic' Attack
3.   MS Plans Final Windows 8.1 Tweak
4.   Barracuda Secures Microsoft Azure
5.   Windows 7 Ends Mainstream Support


advertisement
Kaspersky Looks Inside 'Epic' Attack
Ongoing cyber-espionage analyzed.
Average Rating:
Microsoft Patch Tuesday Stars IE
Biz should focus on browser bulletin.
Average Rating:
MS Plans Final Windows 8.1 Tweak
Focus shifts to upcoming Windows 9.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Mobile Technology Spotlight
Samsung, B&N Target Amazon with Nook Tablet
They've seen the enemy and it is Amazon. So Samsung and Barnes & Noble are teaming up to combat their common foe with a 7-inch tablet that blends Samsung’s tech, Nook’s content and e-reader platform.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Apple Stock Soars Ahead of iPhone 6 Launch
The imminent release of the iPhone 6 -- and maybe even an iWatch -- has sent Apple's stock soaring to new heights. Considering what else the firm could have up its sleeve -- the stratosphere may be the limit.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.