Average Rating: Rate this article:

Ho-Hum Patch Tuesday Missing IE Zero-Day Fix By Jennifer LeClaire January 9, 2013 10:32AM     This Patch Tuesday may be average, but that doesn't mean it'll be an easy one for IT. There are a lot of restarts and they affect nearly all Windows operating systems. That's what security analyst Paul Henry told us. He also found it interesting, but not surprising, that Microsoft was still working on a fix for the Internet Explorer zero-day vulnerability.   Related Topics Microsoft Windows Patch Tuesday Enterprise Security Latest News Reality TV's New Stars: Small Biz Soundbars Up the Ante on TV Sound Google Glass Raises Privacy Concerns Pentagon Gives iOS 6 Security OK Should Enterprises Skip Windows 8? Microsoft on Tuesday launched its first patches for 2013. The release offered seven security bulletins. Two are rated critical and five are rated important. Andrew Storms, director of security operations for nCircle, said the XML bug should be at the top of everyone's "patch immediately" list. That, he said, is because this bug is going to be a popular target for attackers. "If you can't do anything else right away, at least patch this one post haste," Storms told us. "This critical XML bug affects every version of Windows in one way or another because XML is used by a wide range of operating system components." More Attacks Coming Storms also pointed to an interesting bug in Microsoft's print spooler this month. Print spooler bugs played a role in the infamous Stuxnet malware, but Storms said this bug isn't anything like the vulnerability Stuxnet exploited. "This bug requires a watering hole-style attack method, so it'll be pretty popular in attacker forums," Storms said. "This bug should also be patched pronto. Security researchers have confirmed that they can bypass the just released fix-it for the new IE zero-day bug. This news, combined with the fact that attack code for the basic exploit has already made its way into popular toolkits, is not good." Storms predicted IT would continue to see an increase in attacks until Microsoft releases a patch for this flaw. He said it wouldn't surprise him to see an out-of-band patch in the next two weeks for this. As he sees it, this doesn't bode well for 2013, as Microsoft only released one out-of-band patch in all of 2012 and only one in 2011. Boring Patches Tyler Reguly, technical manager of security research and development, reminded us that in many years past Microsoft has started the New Year off with a bang. The patch of the year in 2010 was OpenType Font Code Execution, and the SMB Remote Code Execution was first in 2009. And it was TCP/IP Remote Code Execution that made headlines in January 2008. "The last couple of years have had relatively boring 001 patches, and this year is no different. MS13-001 is assigned to a vulnerability affecting the print spooler. The print spooler itself isn't directly involved; it's third-party products that query it," Reguly said. "Cross-site scripting (XSS) is part of the inaugural Patch Tuesday of 2013. In the past, patching one XSS in a product for Microsoft has often led to other XSS flaws being discovered that year, so this may be the start of a 2013 trend. Instead of SharePoint XSS patches, this may be the year of SCOM XSS patches." (continued...) 1  |  2  |  Next Page >   Tell Us What You Think Comment: Name: Also Visit: iPad Info Center Billions of Bytes Mobile Device Now Apple Info Center TopTechWire.com

Product Information and Resources for Technology You Can Use To Boost Your Business BYOD & MDM   Build a business case for a BYOD program. CRM Systems   Free Download: Understanding the Voice of the Customer   Unlock the potential in your people with Microsoft Dynamics   How Microsoft Dynamics helped mobilize retail businesses   2 million CRM success stories and counting...   Experience CRM and Business Success today with Salesforce.com.   Free Download: Understanding the Voice of the Customer   Optimize CRM with Data Quality Management. More from Trillium Cloud & Virtualization   Riverbed Stingray Traffic Manager on Amazon Web Services Contact Centers   Unlock the potential in your people with Microsoft Dynamics Customer Data   Free Download: Understanding the Voice of the Customer   See how you can benefit from Microsoft Dynamics   Free Download: Understanding the Voice of the Customer Customer Service   Improve your customer relationships with Microsoft Dynamics   2 million CRM success stories and counting...   Unlock the potential in your people with Microsoft Dynamics Data Security   Simpana® 10 software: an exponential leap forward Enterprise Hardware   The 2013 Toughpad™ tablets. Rugged, secure and built for business.   Rugged and reliable Panasonic Toughbook® mobile computers.   The best document scanner for you? Try KODAK's scanner selector   APC makes it easy for you to focus on business growth, not downtime. Enterprise I.T.   Brocade's mission: Making networks easier to deploy, manage, and scale.   11 Challenges Solved by Infrastructure for Small IT Environments Enterprise Software   Get critical data off paper and into SharePoint! Watch the video.   Simpana® 10 software: an exponential leap forward Hardware   The 2013 Toughpad™ tablets. Rugged, secure and built for business.   Rugged and reliable Panasonic Toughbook® mobile computers.   Rugged and reliable Panasonic Toughbook® mobile computers Innovation   The best document scanner for you? Try KODAK's scanner selector   Brocade's mission: Making networks easier to deploy, manage, and scale. Laptops & Tablets   Rugged and reliable Panasonic Toughbook® mobile computers. Mobile Apps   Build great mobile apps that drive engagement. Mobile Tech   Rugged and reliable Panasonic Toughbook® mobile computers Small Business   The best document scanner for you? Try KODAK's scanner selector Tech Trends   APC makes it easy for you to focus on business growth, not downtime.

Network Security Spotlight

Syrian Electronic Army Hacks Financial Times The Financial Times is the latest victim of the Syrian Electronic Army, a group that supports Syrian President Bashar al-Assad. The U.K.-based newspaper said a blog and its Twitter accounts were hacked.   Patch Tuesday Hyper Focuses on IE 8 Microsoft on Tuesday issued 10 security bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.   Surge of Venture Capital Buoys Tech Security Sector With companies and governments spending billions to repel cyberthreats, a surge of venture capital is pouring into companies developing cybersecurity technologies, the front line of the conflict.

Enterprise Hardware Spotlight

U.S. Defense Department Gives iOS 6 Security OK In a vote of confidence for Apple's iOS devices, the Defense Department has given the all-clear for employees to use iPads and iPhones for work. But only those running iOS 6, and only if issued by the government.   Cisco Surges After Profit Exceeds Analysts' Estimates Networking equipment giant Cisco's net income jumped 14 percent in the latest quarter as revenue at all four of its divisions rose for the first time in a year and a half, as tech spending increases.   HP and SAP Team To Advance HANA Database Technology The two tech leaders are working on a system that SAP says could fundamentally change the database market. HANA is SAP's technology that keeps data in-memory, for super fast processing.

Mobile Enterprise Spotlight

Google Glass Raises Congressional Privacy Concerns The buzz around Google Glass continues, but it's not all good. Some in Congress have questions. "We are curious whether this new technology could infringe on the privacy of average Americans," their letter to Google says.   Windows Phone Now No. 3 in Market, BlackBerry No. 4 Has Microsoft Phone moved into a coveted though distant third place for smartphone platforms behind Google's Android and Apple's iOS? A new report says yes, while BlackBerry has slipped to No. 4.   Intel Going Mobile with Its New CEO In his first speech as Intel's CEO, Brian Krzanich said he plans to focus on beefing up Intel's presence in mobility. The next step: a world tour showing mobile devices based on Intel chips, from PCs to phones and tablets.

Enterprise Technology Spotlight

HP and SAP Team To Advance HANA Database Technology The two tech leaders are working on a system that SAP says could fundamentally change the database market. HANA is SAP's technology that keeps data in-memory, for super fast processing.   Cloud Computing Gains Another Competitor with Google Amazon Web Services and Microsoft Azure now have a full-on rival in Google, with its I/O announcement that it is opening its hosted Compute Engine environment for virtual machines to all comers.   Hackers' New Tool of Choice: Smartphones Smartphones are increasingly popular not only with consumers, but with thieves who see the devices as another way to tap into bank accounts and other sensitive information, experts say.

Navigation NewsFactor Network Home/Top News | Enterprise I.T. | Cloud & Virtualization | Applications | Unified Communications | Mobile Tech | Hardware | Business Intelligence World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech Press Releases NewsFactor Network Enterprise I.T. Sites NewsFactor Technology News | Enterprise Security Today | CRM Daily NewsFactor Business and Innovation Sites Sci-Tech Today | NewsFactor Business Report NewsFactor Services FreeNewsFeed | Free Newsletters | About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise Privacy Policy | Terms of Service © Copyright 2000-2013 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.