Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Data Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Microsoft
Microsoft's Patch Tuesday Brings Seven Critical Fixes

By Jennifer LeClaire
April 10, 2012 1:42PM

Bookmark and Share
"The 'deploy now' bulletin this month is MS12-027, a bulletin affecting the Windows Common Controls," said security analyst Andrew Storms of the Microsoft Patch Tuesday fixes. "This component is included in so many Microsoft programs it affects almost every Microsoft user on the planet. It gets worse: Microsoft has already seen exploits for this."
 


Microsoft on Tuesday issued six security bulletins to patch 11 vulnerabilities. Seven of the patches are rated critical.

"The most prominent vulnerabilities are in Internet Explorer, with 4 of the 5 patches marked as critical," John Harrison, group product manager for Symantec Security Response told us after the announcement. "Because the vulnerabilities could allow remote code execution, we recommend users patch as soon as possible."

Indeed, MS12-023 affects all versions of IE. Attacks can exploit the vulnerabilities by setting up a malicious Web page, according to Wolfgang Kandek, CTO of Qualys. We asked him to expound on the patch and how critical it really is.

"MS12-023 has an Exploitability Index of 1, meaning that Microsoft believes that an attack can be crafted within the next 30 days," Kandek said. "By the way, this update does not include the fix for the vulnerability found during last month's PWN2OWN contest at CanSecWest 2012, which will probably be fixed by another IE update next month."

Deploy Now!

Not all security researchers agree on which patches to deploy first. Andrew Storms, director of security operations at nCircle, said it must be a blue moon month because Microsoft is shipping an IE security bulletin but, for the first time in a long time, it won't be on the top of the deployment priority list. He sees another, more critical, issue.

"The 'deploy now' bulletin this month is MS12-027, a bulletin affecting the Windows Common Controls. This component is included in so many Microsoft programs it affects almost every Microsoft user on the planet," Storms said. "It gets worse: Microsoft has already seen exploits for this vulnerability in the wild in limited attacks."

Tyler Reguly, technical manager of security research and development at nCircle, said the work involved in patching every platform affected by MS12-027 may overwhelm smaller shops.

"This bulletin is a great example of why developers should use shared libraries wherever possible," Reguly said. "This should be a simple Windows patch but instead we're seeing every affected application patch the problem independently."

Other Vulnerability News

We also caught up with Paul Henry, a security and forensic analyst at Lumension, to get the broader view of patching during the week. Beyond Apple's Java nightmare last week, he pointed to issues with Adobe, Google and Mozilla worth noting.

"Another recent patch worth mentioning this Patch Tuesday comes from Adobe that fixes two critical vulnerabilities in Flash Player across Solaris, Linux, Mac OS X and Windows platforms," Henry said.

"Google released multiple patches for Chrome this Patch Tuesday period. The latest patch on April 9th addressed 12 security issues and followed the previous patch released just eight days earlier. Mozilla added vulnerable Java Plug-ins to its black list in efforts to protect users in its latest patch."
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Data Security
1.   Retailers Hacked by New Malware
2.   IBM Beefs Up Identity Intelligence
3.   Tor Internet Privacy Service Breached
4.   Tor Working To Fix Security Exploit
5.   Protect Yourself from Identity Theft


advertisement
IBM Beefs Up Identity Intelligence
To offer biz better security products.
Average Rating:
Tor Internet Privacy Service Breached
Users should assume they're affected.
Average Rating:
Protect Yourself from Identity Theft
Even if your data was compromised.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
New 'Backoff' Malware Slips Undetected into Retail Systems
'Malicious actors' are using a new variety of malware to access consumer payment data remotely through point-of-sale systems, according to a report from the Department of Homeland Security.
 
IBM Beefs Up Identity Intelligence Security Solutions
Big Blue is betting big on identity intelligence. IBM just acquired a private firm with security software to govern user access to apps and data across cloud and on-premise environments.
 
USB Security Flaw Lets Hackers Hijack PCs
Hackers can use the firmware that controls USB functions to take control of computers, say security experts. That means there may be a new class of attack for which there are no defenses.
 

Enterprise Hardware Spotlight
AMD's ARM-Based Opteron Out in $3K Dev Kit
It's dubbed "Seattle" and it's AMD's first 64-bit ARM-based Opteron processor. The low-power chip is being released as part of AMD’s Opteron A1100-series developer kit, and aimed at high-end data center needs.
 
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 

Mobile Technology Spotlight
BlackBerry Messenger Now Available on Windows Phone
BlackBerry's free Messenger chatting and voice app is out of beta and widely available for Windows Phone users, the company said. BBM offers secure messaging, Groups, Voice, Channels and more.
 
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.