Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Windows Security
Fiercely productive scanners
Average Rating:
Rate this article:  
Microsoft Security Patches Rolling Hard and Fast in 2013
Microsoft Security Patches Rolling Hard and Fast in 2013

By Jennifer LeClaire
March 13, 2013 12:32PM

Bookmark and Share
"We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft," said security analyst Paul Henry. In 2013, Microsoft is averaging close to nine security patches monthly, including four critical fixes.
 


Just three months into 2013, and a disturbing trend is manifesting at Microsoft: There are a higher number of patches -- and, particularly, critical patches.

In 2012 Microsoft was averaging seven patches, only two of which were critical, each Patch Tuesday. In 2013, Microsoft is averaging close to nine patches monthly, including four critical fixes.

"To really put things in perspective, by March of 2011, Microsoft was averaging close to six patches, with around one critical patch," said Paul Henry, a security and forensic analyst at Lumension. "We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft."

Top Three Priorities

Microsoft on Tuesday issued seven patches, four rated critical. As Henry sees it, the priority is MS13-021, which is a critical patch for Internet Explorer, addressing nine vulnerabilities. Fortunately, he said, none of these "use after free" issues are being publicly exploited.

"Use after free" is receiving more attention recently. However, he emphasized that it's not the delivery mechanism that's a problem. The problem is not taking care of the end game: preventing unauthorized binary from running on your machine in the first place.

"MS13-022 is your second priority. It's a critical update for a remote code execution issue in Silverlight 5. This browse-and-own attack is a pretty standard one, where users might browse to a Web site that has malicious content," Henry said.

"MS13-027 should be your third priority for patching this month, even though it's ranked important by Microsoft because it requires physical access to pull off. Regardless, it's a pretty scary vulnerability. This is an elevation of privilege in kernel mode drivers. Normally, with this sort of vulnerability, a low-level authorized user might be elevated to the system level. However, this one is a little different."

Just Like in the Movies

Andrew Storms, director of security operations at nCircle, agrees that MS13-027 is a serious vulnerability. It allows anyone with a USB stick loaded with attack code and physical access to a computer to subvert security controls. If these conditions are met, he explained, the attack would be successful even if auto-run was disabled and the screen was locked.

"You've seen this attack method in movies for years, and it's now showing in enterprises all over the world," Storms said. "Just imagine what a properly motivated janitorial staff could do with this vulnerability in just one evening. This vulnerability also seriously impacts security on all those public kiosks and co-location centers that don't have locked cabinets. The potential for harm with this vulnerability can't be overstated."

The good news is you don't need to put glue in your USB ports to protect yourself, he said. Either install the patch ASAP, or deploy a Group Policy Object setting to temporarily disable USB ports until the patch is completely deployed.

An Office-Heavy Month

Tyler Reguly, technical manager of security research and development at nCircle, calls March an "Office-heavy" month. The release includes patches for OneNote, Visio and Office for Mac.

"It's interesting that none of the core Office products are patched -- I suspect we'll see them next month," he said. "Today's top priority is the usual suspect, Internet Explorer. This has started to become routine and I'll be more surprised when we have a month where it's not at the top of the list."
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Windows Security
1.   Patch Tuesday Offers Critical Fixes
2.   Microsoft Pulls Plug on Windows XP
3.   Against a Wall, Some Buy XP Support
4.   Last Fixes Tuesday for XP, Office 2003
5.   Despite Its Age, XP Remains a Favorite


advertisement
Last Fixes Tuesday for XP, Office 2003
Microsoft closing out support for two.
Average Rating:
Windows 8 Updates Expected Soon
Using OS feedback, security concerns.
Average Rating:
Microsoft Pulls Plug on Windows XP
Third-party workarounds abound.
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
IBM Offers Security, Disaster Recovery as SoftLayer Service
New disaster recovery and security services for SoftLayer clients are being added by IBM. Big Blue said the new capabilities will speed cloud adoption by alleviating concern over business continuity.
 
How To Beat the Heartbleed Bug
Heartbleed headlines continue as IT admins scramble for answers no one has. Early reports of stolen personal data, including 900 social insurance numbers in Canada, are starting to trickle in.
 
After Heartbleed, OpenSSL Calls for More Support
The president of the OpenSSL Foundation says more support is needed from companies and governments that use its software so that it can better spot and fix flawed pieces of code such as Heartbleed.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
Google Glass may find its first markets in verticals in which hands-free access to data is a boon. Medicine is among the most prominent of those, as seen in a number of Glass experiments under way.
 

Mobile Technology Spotlight
Amazon 3D Smartphone Pics Leaked
E-commerce giant Amazon is reportedly set to launch a smartphone after years of development. Photos of the phone, which may feature a unique 3D interface, were leaked by tech pub BGR.
 
Zebra Tech Buys Motorola Enterprise for $3.45B
Weeks after Lenovo bought Motorola Mobility’s assets from Google for $2.91 million, Zebra Technologies is throwing down $3.45 billion for Motorola’s Enterprise business in an all-cash deal.
 
CTIA Caves, Volunteers Kill Switch Plan
After bucking against the concept of a smartphone kill switch, the CTIA just announced the “Smartphone Anti-Theft Voluntary Commitment” to thwart smartphone thefts in the U.S.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.