HOME     MENU     SEARCH     NEWSLETTER    
TECHNOLOGY, DISCOVERY & INNOVATION. UPDATED 8 MINUTES AGO.
You are here: Home / Windows Security / Light Patch Tuesday, But New Warnings
Neustar, Inc.
Protect your website & network using real-time information & analysis
www.neustar.biz
Light Patch Tuesday, But New Security Advisories Emerge
Light Patch Tuesday, But New Security Advisories Emerge
By Jennifer LeClaire / Sci-Tech Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
OCTOBER
10
2012
Microsoft on Tuesday issued seven bulletins to patch 20 vulnerabilities. Only one patch is critical. The rest are important. But despite the light cycle, IT admins can expect more Microsoft-related work in October.

Andrew Storms, director of security operations for nCircle, said Microsoft is re-releasing a number of patches this month -- in addition to the seven bulletins released as part of the regular patch Tuesday schedule and Monday's Adobe Flash update distributed to Windows 8 users via Windows Update.

Patch Re-Release

"These patches were released earlier this year and have to be re-released due to clerical error with the code signing process at release time. We're also seeing a re-release of an XML Core Services for Windows 8 users, a preventative measure to protect users against potential malicious use of MSXML," Storms told us.

As Storms sees it, the good news is that IT admins don't have to patch Internet Explorer this month since routine fixes were bundled into last month's out-of-band update and, with one exception, the other fixes are fairly tame.

"The RTF bug in Microsoft Word warrants special attention since users can be exploited simply by previewing a malicious RTF file in Outlook," Storms said. "Security teams should prioritize, distribute and install this fix as soon as possible."

Patch this First

We also asked Wolfgang Kandek, CTO of Qualys, for his insights into Microsoft's monthly release. He told us the "critical" bulletin fixes two vulnerabilities in Microsoft Word and applies to all versions of Microsoft Office.

"It addresses a vulnerability that can be exploited via a malicious RTF formatted e-mail through the Outlook Preview pane without having to open the e-mail," Kandek said. "Since the development complexity of an attack against this vulnerability is low, we believe this vulnerability will be the first to have an exploit developed and recommend applying the MS12-064 update as quickly as possible."

New Security Advisories

Besides the seven bulletins, Microsoft is publishing several security advisories. In October, KB2661254 is being switched to automatic download and will start enforcing a minimum of 1024-bit key length for certificates. Key lengths of under 1024 bits are forge-able and certificate authorities have stopped producing such certificates for several years now, he said.

"KB2749655 is a new advisory and explains a problem in Microsoft's code-signing infrastructure. During the three months in the summer of 2012, a number of binary files in Microsoft Security Bulletins were signed in a flawed way that will lead to their loss of validity, causing them to stop working in January 2013," Kandek said.

"To solve the problem, Microsoft will publish new versions of the affected bulletins, and organizations will need to reinstall the affected updates. This month the updated packages are MS12-053, MS12-054, MS12-055 and MS12-058."

Tell Us What You Think
Comment:

Name:

Jamos:
Posted: 2012-10-11 @ 7:22am PT
This patch breaks ICS.

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
BMC's shared success is built on 6 fundamental principles: 1) An Intuitive User Experience 2) Agile Application 3) Actionable Intelligence 4) Adaptive Automation 5) Compliance & Risk Mitigation 6) Optimized Infrastructure & Cost. Contact BMC to learn more.
MORE IN WINDOWS SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.