The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Druva inSync Free Trial
Druva inSync with DLP, analytics & secure file sharing.
www.druva.com/inSync-Trial
You are here: Home / Windows Security / Patch Tuesday Hyper Focuses on IE 8
Is your endpoint data protected?
Patch Tuesday Hyper Focuses on IE 8
Patch Tuesday Hyper Focuses on IE 8
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MAY
14
2013


Microsoft on Tuesday issued 10 security bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.

We caught up with Andrew Storms, director of security operations at Tripwire, to discuss the implications for IT. He told us the quick release of the Internet Explorer 8 patch, which fixes an outstanding zero-day bug reportedly used in a targeted watering hole attack against the US Department of Labor, is a good example of Microsoft's responsiveness to the security community and their users.

"In addition to the zero-day IE8 fix, Microsoft also released an additional security bulletin for Internet Explorer. All users will want to make installation of both patches top priority because browser-based bugs are always high value targets for attackers," Storms said. "For consumers, turning on auto-update is always the best course of action, especially for web browsers, because you will automatically be protected against these kinds of vulnerabilities as soon as a patch is available."

Denial of Service Bug

For all the talk about IE8, though, Storms said there's another patch to pay particular attention to this month. That patch fixes a denial of service bug in IIS, Microsoft's web server. He said there is good news and bad news surrounding this patch.

"The good news is that only Windows 2012 web servers are affected. All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages," Storms said

The bad news, he continued, is that a successful exploit of this bug could have serious implications for public web servers without some kind of inline IPS in front of them. Essentially, he noted, any user could launch a simple attack and the server will essentially be offline.

Microsoft Patch Volume Rising

Wolfgang Kandek, CTO of Qualys, told us that, overall, Microsoft bulletin counts are at least 25 percent higher than in the last couple of years, partly due to the company's decision to go to monthly updates for Internet Explorer.

"Still, it is somewhat surprising given that the market for private vulnerability disclosure seems to have gained structure quite a bit, and I would have expected it to absorb a good part of found vulnerabilities," he said. "Joseph Menn just published an excellent article on this subject over at Reuters -- "Special Report: U.S. cyberwar strategy stokes fear of blowback".

Kandek noted that Adobe is also coming out with updates for three of its products: Coldfusion; Flash; and Reader. The update to Coldfusion addresses a zero-day vulnerability that has an exploit in the wild. Adobe has given workaround instructions in APSA13-03.

Meanwhile, the Reader update contains fixes for 27 vulnerabilities and affects all versions of Reader supported and is rated critical and includes Adobe's fixes for the PWN2OWN vulnerabilities as well. Kandek said to patch this as soon as possible because Adobe Reader is frequently attacked with file-based exploits.

Read more on: Patch, Security, Microsoft, Zero-day
Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
IT departments are embracing cloud backup, but there's a lot you need to know before choosing a service provider. Learn all the critical things you need to know by accessing the white paper, "5 Things You Didn't Know About Cloud Backup". Access the White Paper now.
MORE IN WINDOWS SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Dairy Queen Latest Retailer To Report Hack
Dairy Queen is known for its hot fries and sweet treats, but it just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 

Enterprise Hardware Spotlight
HP Previews ProLiant Gen9 Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 

Mobile Technology Spotlight
Apple Sets Sept. 9 Event: iPhone 6, iWatch on Tap?
Save the date. Apple formally announced that its long-anticipated “special event," will take place on September 9. Does the tech giant have the iPhone 6, and the iWatch up its sleeve?
 
Samsung's New Smart Watch Makes Calls Without Phone
Following up on the Gear 2, Samsung has unveiled a new 3G smart watch, the Gear S, that stands out in its ability to make phone calls and send text messages without a smartphone.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.