The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
GET RECOGNIZED
Let an ISACA® certification elevate your career.
Register today and save
You are here: Home / Network Security / Patch Microsoft IE 9 Vulnerability First
DDoS Protection Powered By Verisign
Analysts: Patch Microsoft IE Drive-By Vulnerability First
Analysts: Patch Microsoft IE Drive-By Vulnerability First
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
NOVEMBER
14
2012


Microsoft on Tuesday released six bulletins as part of its monthly patch process. The patches fix flaws in Windows, Office and .NET Framework.

Microsoft recommends IT admins apply all of the security updates as soon as possible. Redmond prioritized MS12-071, which addresses vulnerabilities in Internet Explorer, and MS12-075, which fixes issues in Windows Kernal-Mode Driver.

"We are committed to improving the security of all our products," said Dave Forstrom, director of Trustworthy Computing at Microsoft. "When security updates are released, customers who have Automatic Updates enabled will be protected automatically and do not need to take an action."

First Things First

We turned to Andrew Storms, director of security operations at nCircle, to get his take on November's Patch Tuesday. He agreed that the priority is the drive-by exploit affecting Internet Explorer 9.

"It's fairly obvious that Microsoft patched this bug in IE10 before its release. Otherwise, we would have a bulletin affecting both IE9 and IE10," Storms told us.

The second bug on his list is MS12-075. One of the bugs in this bulletin affects TrueType fonts and creates a theoretical exploit vector with third-party browsers. Storms recommended patching this one immediately after the IE9 bug.

"The .NET bug that looked problematic in last week's advanced notification is not as serious as it could have been. The remote exploit of this bug is complex; it's going to be difficult for most attackers to use," Storms said. "This is the kind of bug that is a popular tool for pen testers with local network access to show off possible attack vectors, so you should definitely patch it sooner rather than later."

IT Lockdown

Despite the release of Windows 8 in late October, Storms noted that three of Tuesday's bulletins already affect it. Much of the core operating system is reused from version to version, even in new releases, and all software has bugs, he explained. These factors, combined with security researchers that love to find and report bugs in the latest software version, he said, are reasons for the number of bulletins for Windows 8. This should surprise no one.

"Many financial and retail organizations go into IT 'lock-down' for the last few months of the year. They don't want to introduce any changes that may impact their ability to process transactions during the holiday shopping season," Storms said. "It's likely that none of today's patches will be applied to the server infrastructure of these organizations, so Microsoft's comprehensive mitigation advice is critical. It allows these organizations to mitigate the security risk without compromising downtime."

Tyler Reguly, technical manager of security research and development at nCircle, said there's really nothing to talk about with regard to Windows 8 and Server 2012. As he sees it, if you're looking for an operating system without vulnerabilities, you might as well check the end of the rainbow for a pot of gold or try to catch a unicorn.

"Microsoft's recent actions with Flash in IE10 surprised me. I've always felt Security Advisories were the geekier communication mechanism and Security Bulletins were meant for a wider audience," Reguly said. "Yet, they've made the decision to go with Security Advisories only for Flash updates, a divergence from the approach they took when XP shipped with Flash built-in."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN NETWORK SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 
Are Government Spies Tipping Off Tor?
Less than a month ago, tech news headlines heralded a Tor Project breach. Now, some are saying that government spies are sharing information with Tor to help it prevent future breaches.
 
Backoff Malware Hits 1,000+ Businesses, Likely More
More than 1,000 businesses across the U.S. might have been affected by Backoff, a new kind of point-of-sale (PoS) malware, according to the Department of Homeland Security.
 

Enterprise Hardware Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Mobile Technology Spotlight
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Verizon Hops on the Voice-Over-LTE Bandwagon
Wireless provider Verizon is gearing up for a nationwide launch of its Voice-over-LTE service over the next several weeks, promising clearer and crisper phone calls and a Skype-like video service.
 
Smartphone 'Kill Switch' Law in California; Will Other States Follow?
California’s new law -- signed by Gov. Jerry Brown on Monday -- aimed at deterring cellphone theft could mean most mobile phones sold in the U.S. will soon include similar “kill-switch” tech.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.