Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
Windows Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Microsoft Patch Tuesday To Bring Heavy Office Emphasis
Microsoft Patch Tuesday To Bring Heavy Office Emphasis

By Jennifer LeClaire
March 8, 2013 10:56AM

Bookmark and Share
"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," said security expert Ross Barrett about Microsoft's next Patch Tuesday. Of the seven security fixes Microsoft is releasing for Patch Tuesday, four are rated as critical.
 


Call it March Madness. Microsoft on Tuesday will roll out seven security bulletins. Four of the bulletins are rated critical and three are rated important -- and some require restarts.

The critical bulletins affect Microsoft Windows, Silverlight for Office, and Microsoft Server software. The other bulletins aim to fix vulnerabilities in Office and Windows.

"IT admins can't seem to catch a break this year. First, the never-ending stream of Java issues that has kept folks on their toes since January," said Paul Henry, a security and forensic analyst at Lumension. "Now they've got another busy month of patches ahead of them, with seven total patches from Microsoft, four of which are critical. However, once again the issues outside of Microsoft will likely eclipse the Patch Tuesday issues this month."

A Heavy Office Focus

Ross Barrett, senior manager of security engineering at Rapid 7, told us it was interesting that Bulletin 1 does not list Internet Explorer 10 on Windows 7 as vulnerable. It may be an omission, he said, or it may be that the fix was included when IE 10 was released for Windows 7 systems last week. Regardless, he said, this is where he would prioritize his patching efforts.

"From this vantage, my gut feel is that Bulletin 3 is the second most important to patch, followed by either of the two other critical issues," Barrett said. "The information disclosure issues in Office I would patch when it isn't going to impact your users in any way. One of them, at least, will not require a restart."

Barrett also pointed to Bulletin 4, which is only an "elevation of privilege" vulnerability. Still, he said, it's listed as critical. That may mean that it is remotely exploitable with a known user name, or that it is already being exploited in the wild.

Meanwhile, Bulletin 2 is listed as critical in Silverlight, which is interesting to Barrett since Silverlight is not among Microsoft's most popular apps. He suggested users who have installed Silverlight should deploy this patch quickly since the risk would be on par with a Flash vulnerability.

"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," Barrett said. "It seems likely that the seventh bulletin is another Windows kernel or kernel driver issue, since it is a core operating system vulnerability, requires a restart, and the risk is elevation of privilege."

PWN2OWN Results

In other security news, the ZDI's PWN2OWN competition is going on at the CanSecWest security conference in Vancouver. PWN2OWN awards prizes ranging from $20,000 to $100,000 to security researchers that demonstrate vulnerabilities in Adobe Flash, Adobe Reader, Google Chrome, Internet Explorer, Firefox and Java.

"In Wednesday's run, prizes have been claimed for Oracle Java by James Forshaw, Oracle Java again by Joshua Drake, IE10 on Windows 8 by VUPEN, Google Chrome on Windows 7 by a team from MWR Labs, John and Nils, and finally Mozilla Firefox and Oracle Java, both by the team at VUPEN," said Wolfgang Kandek, CTO at Qualys. "You can expect patches for these vulnerabilities to be released over the coming weeks."
 

Tell Us What You Think
Comment:

Name:



Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.


 Windows Security
1.   Patch Tuesday Offers Critical Fixes
2.   Microsoft Pulls Plug on Windows XP
3.   Against a Wall, Some Buy XP Support
4.   Last Fixes Tuesday for XP, Office 2003
5.   Despite Its Age, XP Remains a Favorite


advertisement
Last Fixes Tuesday for XP, Office 2003
Microsoft closing out support for two.
Average Rating:
Windows 8 Updates Expected Soon
Using OS feedback, security concerns.
Average Rating:
Microsoft Pulls Plug on Windows XP
Third-party workarounds abound.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
What Verizon's Data Breach Report Can Teach Enterprises
It’s probably not a jaw-dropper, but cyberespionage is officially on the rise. And the use of stolen or misused credentials is still the leading way the bad guys gain access to corporate information.
 
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 
Where Do Web Sites Stand, Post-Heartbleed?
A security firm says the vast majority of Web sites have patched themselves to protect against the Heartbleed bug, but now there are questions raised on the reliability of open-source programs.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.