HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 14 MINUTES AGO.
You are here: Home / Windows Security / Sept. Patch Tuesday One To Remember
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
Sept. Patch Tuesday One To Remember, With 13 Bulletins
Sept. Patch Tuesday One To Remember, With 13 Bulletins
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
SEPTEMBER
11
2013
Microsoft on Tuesday issued 13 security bulletins. Four are rated critical. The cumulative 47 patches address vulnerabilities in Microsoft Windows, Office, Outlook, Internet Explorer and SharePoint. Microsoft recommends focusing on MS13-067, MS13-068, and MS13-069 first.

"While the Outlook bulletin is certainly one to pay attention to, building a reliable exploit for this issue won't be easy," said Dustin Childs, group manager, Microsoft Trustworthy Computing. "Still, we've listed this update as one of our highest priorities for this month and encourage customers to deploy the bulletins to help ensure protection."

2004 Risks Real Again

Microsoft is putting top priority on MS13-067, which affects SharePoint Server. The most severe vulnerability is CVE-2013-1330, which allows remote code execution by malicious content sent to the server without user interaction, genuine real-time remote exploitation, said Ross Barrett, a senior manager of security engineering at Rapid 7.

"Of the 10 CVEs, one is public, but supposedly that is not CVE-2013-1330," he told us. "There is a workaround for CVE-2013-1330 related to enabling state inspection for message authentication code attributes."

The other two critical advisories require user interaction to trigger the vulnerabilities. However, Barrett noted that MS13-068 affecting Microsoft Outlook is particularly toxic because it can be triggered when users view malicious content in the Outlook preview pane.

"Apparently, we have gone back in time and the risks from 2004 are real again," he said. "This is pretty significant and administrators will have to move fast to patch this before exploits appear."

SharePoint Shops Beware

MS13-070 is concerning to Barrett because it only applies to XP and Server 2003, and those vulnerabilities tend to be less "contained" than more mature versions of Windows.

"If you are running an MS-heavy shop and have significantly invested in the back office technology of SharePoint and all its glorious services, then this month is going to be very busy for you," he said.

"There are lots of vulnerabilities to patch, many of which are high risk. Office vulnerabilities are typically mitigated by the fact that they require a user to interact with something malicious, either through an attachment or a link, in order to be exploited. But with the SharePoint that degree of mitigation may go away and other factors of defense-in-depth will come into play."

The Hardest Hit

We turned to Paul Henry, a security and forensics analyst at Lumension, to get his take on this month's Patch Tuesday. He told us this is definitely a September to remember. By way of comparison, September 2012's release only contained two bulletins -- and both were rated as important.

"We're seeing big numbers this month but there is perhaps some good news: only four patches are considered critical, two were publicly known yet Microsoft has not seen active attacks on any of the September CVEs to-date and none of them impact the current code base," Henry said.

IE, SharePoint and Outlook are hardest hit this month, Henry said, and vulnerabilities in XP and Windows 2003 were also patched -- a practice he hopes to see more of as the XP end-of-life date of April 8, 2014, nears. Windows 2003 has an end-of-life date of July 14, 2015. For anyone using XP, he said, a migration plan should be put in place if you do not already have one.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
ISACA® offers a global community of more than 115,000 IS/IT constituents in over 180 countries. We develop and deliver industry-leading certifications, education, research and business frameworks. We equip individuals to be leaders in the fast-changing world of information systems and IT - Learn More>
MORE IN WINDOWS SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Microsoft has some bitter rivals in the technology industry, but when it comes to thwarting government intrusion on customer privacy the software giant has plenty in common with its rivals.

ENTERPRISE HARDWARE SPOTLIGHT
Almost half of consumer, industry and life sciences manufacturers are expected to be using 3D printers within three years and now 3D printing services are aiming to help companies experiment.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.