Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Build Apps 5x Faster
For Half the Cost
Enterprise Cloud Computing

On Force.com
Windows Security
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
Microsoft Security Patches Rolling Hard and Fast in 2013

Microsoft Security Patches Rolling Hard and Fast in 2013
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

"We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft," said security analyst Paul Henry. In 2013, Microsoft is averaging close to nine security patches monthly, including four critical fixes.
 


Just three months into 2013, and a disturbing trend is manifesting at Microsoft: There are a higher number of patches -- and, particularly, critical patches.

In 2012 Microsoft was averaging seven patches, only two of which were critical, each Patch Tuesday. In 2013, Microsoft is averaging close to nine patches monthly, including four critical fixes.

"To really put things in perspective, by March of 2011, Microsoft was averaging close to six patches, with around one critical patch," said Paul Henry, a security and forensic analyst at Lumension. "We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft."

Top Three Priorities

Microsoft on Tuesday issued seven patches, four rated critical. As Henry sees it, the priority is MS13-021, which is a critical patch for Internet Explorer, addressing nine vulnerabilities. Fortunately, he said, none of these "use after free" issues are being publicly exploited.

"Use after free" is receiving more attention recently. However, he emphasized that it's not the delivery mechanism that's a problem. The problem is not taking care of the end game: preventing unauthorized binary from running on your machine in the first place.

"MS13-022 is your second priority. It's a critical update for a remote code execution issue in Silverlight 5. This browse-and-own attack is a pretty standard one, where users might browse to a Web site that has malicious content," Henry said.

"MS13-027 should be your third priority for patching this month, even though it's ranked important by Microsoft because it requires physical access to pull off. Regardless, it's a pretty scary vulnerability. This is an elevation of privilege in kernel mode drivers. Normally, with this sort of vulnerability, a low-level authorized user might be elevated to the system level. However, this one is a little different."

Just Like in the Movies

Andrew Storms, director of security operations at nCircle, agrees that MS13-027 is a serious vulnerability. It allows anyone with a USB stick loaded with attack code and physical access to a computer to subvert security controls. If these conditions are met, he explained, the attack would be successful even if auto-run was disabled and the screen was locked.

"You've seen this attack method in movies for years, and it's now showing in enterprises all over the world," Storms said. "Just imagine what a properly motivated janitorial staff could do with this vulnerability in just one evening. This vulnerability also seriously impacts security on all those public kiosks and co-location centers that don't have locked cabinets. The potential for harm with this vulnerability can't be overstated."

The good news is you don't need to put glue in your USB ports to protect yourself, he said. Either install the patch ASAP, or deploy a Group Policy Object setting to temporarily disable USB ports until the patch is completely deployed.

An Office-Heavy Month

Tyler Reguly, technical manager of security research and development at nCircle, calls March an "Office-heavy" month. The release includes patches for OneNote, Visio and Office for Mac.

"It's interesting that none of the core Office products are patched -- I suspect we'll see them next month," he said. "Today's top priority is the usual suspect, Internet Explorer. This has started to become routine and I'll be more surprised when we have a month where it's not at the top of the list."
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Windows Security
1.   Microsoft Patch Tuesday Stars IE
2.   Kaspersky Looks Inside 'Epic' Attack
3.   MS Plans Final Windows 8.1 Tweak
4.   Barracuda Secures Microsoft Azure
5.   Windows 7 Ends Mainstream Support


advertisement
Kaspersky Looks Inside 'Epic' Attack
Ongoing cyber-espionage analyzed.
Average Rating:
Microsoft Patch Tuesday Stars IE
Biz should focus on browser bulletin.
Average Rating:
MS Plans Final Windows 8.1 Tweak
Focus shifts to upcoming Windows 9.
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Chinese Hackers Nab Info on Millions of U.S. Patients
A group of Chinese hackers has stolen the personal information, including names and Social Security numbers, of about 4.5 million patients at hospitals operated by Community Health Systems.
 
Premier FBI Cybersquad in U.S. To Add Agents
After helping prosecutors charge Chinese army officials with stealing trade secrets from major companies and by snaring a Russian-led hacking ring, the premier FBI cyber-squad is getting a boost.
 
Apple Opens iCloud Data Center in China
Treading lightly, Apple acknowledged it has started to store encrypted iCloud personal data of some Chinese users on servers in mainland China, operated by the state-owned China Telecom.
 

Enterprise Hardware Spotlight
Compression, Deduplication Come to Violin Concerto 2200
Violin Memory has announced that data deduplication and compression capabilities are now available on its Concerto 2200 solution. Typically, users will experience deduplication rates between 6:1 and 10:1.
 
Cisco Axes 6,000 Employees in Restructuring Plan
Faced with declining profits, Cisco is laying off up to 6,000 employees in the months ahead -- a whopping 8 percent of its global workforce. That's in addition to the 4,000 jobs Cisco cut last year.
 
Web Slows, Have Internet Routers Reached The Limit?
If you encountered problems connecting to the Internet on August 12, you weren't alone. Networking experts blame the wide-scale slowdown on outdated routing systems that are reaching their limits.
 

Mobile Technology Spotlight
Apple Stock Soars Ahead of iPhone 6 Launch
The imminent release of the iPhone 6 -- and maybe even an iWatch -- has sent Apple's stock soaring to new heights. Considering what else the firm could have up its sleeve -- the stratosphere may be the limit.
 
HTC Debuts Windows Phone Version of One M8 Smartphone
HTC is bringing the Windows Phone mobile OS to its flagship One M8 device -- the first time any mainstream flagship smartphone has been offered with a choice of operating systems.
 
Verizon Earns Top Rating in Mobile Network Comparison
A new report says Verizon Wireless was the top-performing U.S. cellphone service provider in the first half of 2014, on a nationwide and state-by-state basis, as well as in metro areas.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.