HOME     MENU     SEARCH     NEWSLETTER    
TECHNOLOGY, DISCOVERY & INNOVATION. UPDATED 7 MINUTES AGO.
You are here: Home / Microsoft/Windows / Microsoft Patches Surface & Security
Microsoft Patch Tuesday Brings Critical Fixes, Also for Surface
Microsoft Patch Tuesday Brings Critical Fixes, Also for Surface
By Jennifer LeClaire / Sci-Tech Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
NOVEMBER
09
2012

Most consumers haven't even received their Microsoft Surface tablets yet. But on Patch Tuesday, Redmond will be rolling out a patch for the Windows 8 RT version of its sleek new portable device.

Microsoft will issue six bulletins to address vulnerabilities in Microsoft Windows, Internet Explorer, Microsoft .NET Framework, and Microsoft Office. Four of the bulletins are rated critical, one is rated important and one moderate. And Windows 8 RT is included in the mix.

"It doesn't matter if you're still running Windows XP SP3 or Windows 8 -- it's important to sit up, pay attention, and take action whenever Microsoft issues security updates," Graham Cluley, a senior security analyst at Sophos, wrote in a blog post. "And that's a lesson that users of the new Microsoft Surface tablet are going to have to learn as well if they're going to reduce the chances of an Internet attack being successful."

Impacting Current Gen Products

We caught up with Paul Henry, a security and forensic analyst at Lumension, to get his take on the upcoming bulletins. He told us IT admins may find they don't have much to be thankful for this Thanksgiving with a disruptive Patch Tuesday headed their way.

"With 6 Microsoft bulletins, 4 of which are critical and some restarts required, along with a host of other issues, IT can expect a disruptive Patch Tuesday this month," Henry said.

"Right off the top, it's disappointing to see the critical bulletins impacting more than just legacy code as we've come to expect in recent months. These bulletins impact many current generation products and that's concerning. Nothing is ever 100 percent secure and albeit mistakes are made in software. But it's still ugly to see."

Reviewing the Bulletins

Bulletin 1 is an update for IE 9. Henry calls it a pretty standard but critical cumulative IE update as it addresses three vulnerabilities. Although nothing is under active attack, he said it should be considered the highest priority for shops running Windows 7 or Vista.

"Bulletin 5 is an interesting one, because it's a true type font issue. It resolves three vulnerabilities, the worst of which is a remote code execution. Microsoft has been dealing with font issues for a while. True Type Fonts can be embedded all over the place and Windows kernel mode driver renders the font," Henry said.

"If these fonts are embedded in a browser or a Word document, for example, it's rendered in the kernel mode driver and winds up becoming a kernel mode exploit. An authenticated, low-rights user could visit a Web site, the font gets rendered, and it gets rendered as 'system.' This is a very effective attack mode, so Microsoft likes to close out font issues quickly. This is as high a priority as Bulletin 1. Those two bulletins will be the two biggest attack vectors in this batch."

Bulletin 2 addresses two vulnerabilities that are critical remote code executions. This is a Briefcase issue, where you have mapped drives with Briefcase, and Henry classifies it as high priority. Meanwhile, Bulletin 4 affects .Net and fixes Bulletin 5 vulnerabilities in the .Net framework. Bulletin 6 is an Excel vulnerability.

"Bulletin 3 is a moderate update for IIS, which could cause concern. But this is an information disclosure issue via FTP only, so it's only a concern if you have IIS set up to provide FTP services," Henry said. "It's moderate, which typically means attackers have to authenticate to pull off the attack. And we all recognize if they can authenticate, they pretty much own the machine anyway."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
UCS Invicta: Integrated Flash Why wait for the future? Unlock the potential of your applications and create new business opportunities today with UCS Invicta Series Solid State Systems. Take advantage of the power of flash technology. See how it can help accelerate IT, eliminate data center bottlenecks, and deliver the peak application performance and predictability your users demand. Click here to learn more.
MORE IN MICROSOFT/WINDOWS
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
It might not happen today or tomorrow, but a major cyberattack on a telecom network will likely happen in the next decade, and it could bring with it great damage to finances and security.

ENTERPRISE HARDWARE SPOTLIGHT
Making a major change to its usually staid design philosophy, HP unveiled an all-in-one PC with built-in projector and surface-enabled touch, designed to make 3D scanning and printing easy.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.