Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Network Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Microsoft Security Patches Rolling Hard and Fast in 2013
Microsoft Security Patches Rolling Hard and Fast in 2013

By Jennifer LeClaire
March 13, 2013 12:32PM

    Bookmark and Share
"We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft," said security analyst Paul Henry. In 2013, Microsoft is averaging close to nine security patches monthly, including four critical fixes.
 



Just three months into 2013, and a disturbing trend is manifesting at Microsoft: There are a higher number of patches -- and, particularly, critical patches.

In 2012 Microsoft was averaging seven patches, only two of which were critical, each Patch Tuesday. In 2013, Microsoft is averaging close to nine patches monthly, including four critical fixes.

"To really put things in perspective, by March of 2011, Microsoft was averaging close to six patches, with around one critical patch," said Paul Henry, a security and forensic analyst at Lumension. "We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft."

Top Three Priorities

Microsoft on Tuesday issued seven patches, four rated critical. As Henry sees it, the priority is MS13-021, which is a critical patch for Internet Explorer, addressing nine vulnerabilities. Fortunately, he said, none of these "use after free" issues are being publicly exploited.

"Use after free" is receiving more attention recently. However, he emphasized that it's not the delivery mechanism that's a problem. The problem is not taking care of the end game: preventing unauthorized binary from running on your machine in the first place.

"MS13-022 is your second priority. It's a critical update for a remote code execution issue in Silverlight 5. This browse-and-own attack is a pretty standard one, where users might browse to a Web site that has malicious content," Henry said.

"MS13-027 should be your third priority for patching this month, even though it's ranked important by Microsoft because it requires physical access to pull off. Regardless, it's a pretty scary vulnerability. This is an elevation of privilege in kernel mode drivers. Normally, with this sort of vulnerability, a low-level authorized user might be elevated to the system level. However, this one is a little different."

Just Like in the Movies

Andrew Storms, director of security operations at nCircle, agrees that MS13-027 is a serious vulnerability. It allows anyone with a USB stick loaded with attack code and physical access to a computer to subvert security controls. If these conditions are met, he explained, the attack would be successful even if auto-run was disabled and the screen was locked.

"You've seen this attack method in movies for years, and it's now showing in enterprises all over the world," Storms said. "Just imagine what a properly motivated janitorial staff could do with this vulnerability in just one evening. This vulnerability also seriously impacts security on all those public kiosks and co-location centers that don't have locked cabinets. The potential for harm with this vulnerability can't be overstated."

The good news is you don't need to put glue in your USB ports to protect yourself, he said. Either install the patch ASAP, or deploy a Group Policy Object setting to temporarily disable USB ports until the patch is completely deployed.

An Office-Heavy Month

Tyler Reguly, technical manager of security research and development at nCircle, calls March an "Office-heavy" month. The release includes patches for OneNote, Visio and Office for Mac.

"It's interesting that none of the core Office products are patched -- I suspect we'll see them next month," he said. "Today's top priority is the usual suspect, Internet Explorer. This has started to become routine and I'll be more surprised when we have a month where it's not at the top of the list."
 

Tell Us What You Think
Comment:

Name:





 Network Security
1.   Tor Working To Fix Security Exploit
2.   Wall Street Journal Hacked Again
3.   Dropbox for Business Boosts Security
4.   Hackers Breached StubHub Accounts
5.   Banks Hit by Android-Skirting Malware


advertisement
Tor Working To Fix Security Exploit
Bug reportedly reveals ID of users
Average Rating:
New Technology Defeats Privacy Efforts
Study identifies 3 browser techniques.
Average Rating:
Banks Hit by Android-Skirting Malware
34 institutions, four European countries
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 
Dropbox for Business Beefs Up Security
Dropbox is upping its game for business users. The cloud-based storage and sharing company has rolled out new security, search and other features to boost its appeal for businesses.
 

Enterprise Hardware Spotlight
Watson Gets His First Customer Service Gig
Since appearing on Jeopardy, IBM's Watson supercomputer has been making a living using his super-intelligent knowledge base for business verticals. Now, Watson's been hired for his first customer service job.
 
Tablet Giants Apple and Samsung Feel the Heat
When a company saturates its home market with a once-hot product, expect it to pump up efforts elsewhere. Apple, for its part, is now pushing iPads to big corporations and the enterprise market.
 
Microsoft Makes Design Central to Its Future
Over the last four years, Microsoft has doubled the number of designers it employs, putting a priority on fashioning devices that work around people's lives -- and that are attractive and cool.
 

Mobile Technology Spotlight
Tablet Giants Apple and Samsung Feel the Heat
When a company saturates its home market with a once-hot product, expect it to pump up efforts elsewhere. Apple, for its part, is now pushing iPads to big corporations and the enterprise market.
 
Is the Amazon Fire Phone a Winner?
A late entry into a packed category of smartphones, Amazon's Fire phone offers a variety of unique features. Now, the reviewers are assessing if they're enough to make the phone stand out.
 
Review: Amazon Fire Offers New Ways To Use Phones
The Fire phone uses Android, but Amazon has modified it to the point that it's barely recognizable. That means the phone offers new ways to navigate, discover and, of course, shop.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.