Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
Vblock™ Systems:
Advanced converged infrastructure
increases productivity & lowers costs.

www.vce.com
Windows Security
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Patch Tuesday Hyper Focuses on IE 8
Patch Tuesday Hyper Focuses on IE 8

By Jennifer LeClaire
May 14, 2013 3:40PM

Bookmark and Share
"The good news is that only Windows 2012 web servers are affected," explained security expert Andrew Storms. "All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages."
 

Related Topics

Patch
Security
Microsoft
Zero-day


Microsoft on Tuesday issued 10 security bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.

We caught up with Andrew Storms, director of security operations at Tripwire, to discuss the implications for IT. He told us the quick release of the Internet Explorer 8 patch, which fixes an outstanding zero-day bug reportedly used in a targeted watering hole attack against the US Department of Labor, is a good example of Microsoft's responsiveness to the security community and their users.

"In addition to the zero-day IE8 fix, Microsoft also released an additional security bulletin for Internet Explorer. All users will want to make installation of both patches top priority because browser-based bugs are always high value targets for attackers," Storms said. "For consumers, turning on auto-update is always the best course of action, especially for web browsers, because you will automatically be protected against these kinds of vulnerabilities as soon as a patch is available."

Denial of Service Bug

For all the talk about IE8, though, Storms said there's another patch to pay particular attention to this month. That patch fixes a denial of service bug in IIS, Microsoft's web server. He said there is good news and bad news surrounding this patch.

"The good news is that only Windows 2012 web servers are affected. All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages," Storms said

The bad news, he continued, is that a successful exploit of this bug could have serious implications for public web servers without some kind of inline IPS in front of them. Essentially, he noted, any user could launch a simple attack and the server will essentially be offline.

Microsoft Patch Volume Rising

Wolfgang Kandek, CTO of Qualys, told us that, overall, Microsoft bulletin counts are at least 25 percent higher than in the last couple of years, partly due to the company's decision to go to monthly updates for Internet Explorer.

"Still, it is somewhat surprising given that the market for private vulnerability disclosure seems to have gained structure quite a bit, and I would have expected it to absorb a good part of found vulnerabilities," he said. "Joseph Menn just published an excellent article on this subject over at Reuters -- "Special Report: U.S. cyberwar strategy stokes fear of blowback".

Kandek noted that Adobe is also coming out with updates for three of its products: Coldfusion; Flash; and Reader. The update to Coldfusion addresses a zero-day vulnerability that has an exploit in the wild. Adobe has given workaround instructions in APSA13-03.

Meanwhile, the Reader update contains fixes for 27 vulnerabilities and affects all versions of Reader supported and is rated critical and includes Adobe's fixes for the PWN2OWN vulnerabilities as well. Kandek said to patch this as soon as possible because Adobe Reader is frequently attacked with file-based exploits.
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Windows Security
1.   Patch Tuesday Offers Critical Fixes
2.   Microsoft Pulls Plug on Windows XP
3.   Against a Wall, Some Buy XP Support
4.   Last Fixes Tuesday for XP, Office 2003
5.   Despite Its Age, XP Remains a Favorite


advertisement
Last Fixes Tuesday for XP, Office 2003
Microsoft closing out support for two.
Average Rating:
Windows 8 Updates Expected Soon
Using OS feedback, security concerns.
Average Rating:
Microsoft Pulls Plug on Windows XP
Third-party workarounds abound.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Tech Giants Fund Initiative To Prevent Future Heartbleeds
Can more funding prevent Heartbleed vulnerabilities in future open-source software? A new Core Infrastructure Initiative at the Linux Foundation is attempting to find out.
 
What Verizon's Data Breach Report Can Teach Enterprises
It’s probably not a jaw-dropper, but cyberespionage is officially on the rise. And the use of stolen or misused credentials is still the leading way the bad guys gain access to corporate information.
 
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.