The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Druva inSync Free Trial
Druva inSync with DLP, analytics & secure file sharing.
www.druva.com/inSync-Trial
You are here: Home / Windows Security / Microsoft Ships IE Zero-Day Flaw Fix
Is your endpoint data protected?
Microsoft Ships Fix for IE Zero-Day Flaw
Microsoft Ships Fix for IE Zero-Day Flaw
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
NOVEMBER
13
2013


On Tuesday, Microsoft issued eight security bulletins for its monthly update. The bulletins address 19 vulnerabilities across Microsoft Windows, Internet Explorer and Office. Three of them are critical.

But Redmond didn’t stop there. The software giant also issued three new advisories: Security Advisory 2862152, Security Advisory 2868725 and Security Advisory 2880823. What’s more, two additional advisories were revised: Security Advisory 2755801 and Security Advisory 2854544 to provide updates for Adobe Flash on IE 10 and improve digital certificate handling in Windows.

We caught up with Tyler Reguly, technical manager of security research and development at Tripwire, to get his take on November’s Patch Tuesday. He told us IT pros everywhere will have a little less weight on their shoulders because Microsoft shipped a fix for the current IE zero-day.

“It's important to note, however, that the fix is not in the traditional IE Cumulative Update -- MS13-088 -- but rather in a separate ActiveX fix -- MS13-090,” Reguly said. “Also patched this month is GDI, and while the bulletin wouldn't normally merit a critical rating, the vulnerability exists in a common API call that may be implemented by numerous third-party products. In addition to applying today's patches, keep an eye out for security updates from other vendors that make use of the built-in Windows' graphics libraries.”

Unique Outlook Vulnerability

As Reguly sees it, the more interesting patches this month are for a unique Outlook vulnerability that could allow port-scanning, a Hyper-V vulnerability that could allow Guest OS to Guest OS code execution, and an X.509 issue in schannel.dll that could allow denial of service. While these are unique and interesting vulnerabilities, he said, they pose a lot less risk than typical code execution vulnerabilities.

“It’s interesting that Microsoft released an update for Direct Access that is not considered a ‘security update.' The update resolves a known CVE, but Microsoft didn’t deem it worthy of a bulletin. Generally this implies the update is a functionality change in the software, rather than a pure security fix,” he said.

“While the process makes sense on paper, it makes it much more difficult for administrators to recognize that additional patches that actually resolve vulnerabilities are available for their systems. Regardless of the severity of the issue, not issuing a bulletin decreases security for users of Direct Access everywhere,” he added.

Your Highest Priority

Craig Young, a security researcher at Tripwire, told us the highest priority for most organizations will be to deploy the IE fix that blocks access to the InfoCard control being exploited in targeted watering-hole attacks. As critical as it is, he said, the IE zero-day appears to be a run of the mill ActiveX memory corruption bug.

“MS13-094 can allow remote attackers to craft S/MIME emails for the purpose of running a port scan from a victim system. This is possible because when viewed in Outlook, the S/MIME message could trigger HTTP requests to arbitrary hosts/ports during signature validation,” he explained.

“The attacker can then perform a timing analysis to get an idea of which hosts/ports are accessible from the victim machine. This information can be leveraged in future attacks. Microsoft resolved this issue by limiting the number of S/MIME signers processed,” he said.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
IT departments are embracing cloud backup, but there's a lot you need to know before choosing a service provider. Learn all the critical things you need to know by accessing the white paper, "5 Things You Didn't Know About Cloud Backup". Access the White Paper now.
MORE IN WINDOWS SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Russian Gang with Stolen IDs Hacks Hosting Company
In August, a Russian cyber gang obtained what researchers called “the largest cache of stolen data." Now, those hackers may be putting their ill-gotten gains to criminal use.
 
Dairy Queen Latest Retailer To Report Hack
Known for its hot fries and soft-serve ice cream, Dairy Queen just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 

Enterprise Hardware Spotlight
AMD's New FX Series CPU Breaks Processing Speed Record
The new FX-8370 processor from Advanced Micro Devices has set a record for silicon processor speed, the company announced. Overclocked, the eight-core chip was measured at 8722.78 MHz.
 
Intel Intros Lightning-Fast PC Processors
Call it extreme. Intel just took the covers off its first-ever eight-core desktop processor, which is aimed at hardcore power users who expect more than the status quo from their computers.
 
HP Previews ProLiant Gen9 Data Center Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 

Mobile Technology Spotlight
Rumor Mill Puts Mobile Wallet in iPhone 6
Apple is moving toward the mobile wallet world with its next iPhone. The tech giant has partnered with retailers, banks and major payment networks to make it happen, according to Bloomberg.
 
Will iPhone Finally Catch Up with NFC Mobile Payment Ability?
Apple's latest version of the iPhone may have a mobile wallet to pay for purchases with a tap of the phone. The iPhone 6 reportedly is equipped with near-field communication (NFC) technology.
 
Visual Search To Shop: Gimmick or Game Changing?
Imagine using your phone to snap a photo of the cool pair of sunglasses your friend is wearing and instantly receiving a slew of information about the shades along with a link to order them.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.