Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Microsoft/Windows
Next Generation Data Center Is Here!
Average Rating:
Rate this article:  
Microsoft Patch Tuesday To Bring Heavy Office Emphasis
Microsoft Patch Tuesday To Bring Heavy Office Emphasis

By Jennifer LeClaire
March 8, 2013 10:56AM

    Bookmark and Share
"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," said security expert Ross Barrett about Microsoft's next Patch Tuesday. Of the seven security fixes Microsoft is releasing for Patch Tuesday, four are rated as critical.
 


Call it March Madness. Microsoft on Tuesday will roll out seven security bulletins. Four of the bulletins are rated critical and three are rated important -- and some require restarts.

The critical bulletins affect Microsoft Windows, Silverlight for Office, and Microsoft Server software. The other bulletins aim to fix vulnerabilities in Office and Windows.

"IT admins can't seem to catch a break this year. First, the never-ending stream of Java issues that has kept folks on their toes since January," said Paul Henry, a security and forensic analyst at Lumension. "Now they've got another busy month of patches ahead of them, with seven total patches from Microsoft, four of which are critical. However, once again the issues outside of Microsoft will likely eclipse the Patch Tuesday issues this month."

A Heavy Office Focus

Ross Barrett, senior manager of security engineering at Rapid 7, told us it was interesting that Bulletin 1 does not list Internet Explorer 10 on Windows 7 as vulnerable. It may be an omission, he said, or it may be that the fix was included when IE 10 was released for Windows 7 systems last week. Regardless, he said, this is where he would prioritize his patching efforts.

"From this vantage, my gut feel is that Bulletin 3 is the second most important to patch, followed by either of the two other critical issues," Barrett said. "The information disclosure issues in Office I would patch when it isn't going to impact your users in any way. One of them, at least, will not require a restart."

Barrett also pointed to Bulletin 4, which is only an "elevation of privilege" vulnerability. Still, he said, it's listed as critical. That may mean that it is remotely exploitable with a known user name, or that it is already being exploited in the wild.

Meanwhile, Bulletin 2 is listed as critical in Silverlight, which is interesting to Barrett since Silverlight is not among Microsoft's most popular apps. He suggested users who have installed Silverlight should deploy this patch quickly since the risk would be on par with a Flash vulnerability.

"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," Barrett said. "It seems likely that the seventh bulletin is another Windows kernel or kernel driver issue, since it is a core operating system vulnerability, requires a restart, and the risk is elevation of privilege."

PWN2OWN Results

In other security news, the ZDI's PWN2OWN competition is going on at the CanSecWest security conference in Vancouver. PWN2OWN awards prizes ranging from $20,000 to $100,000 to security researchers that demonstrate vulnerabilities in Adobe Flash, Adobe Reader, Google Chrome, Internet Explorer, Firefox and Java.

"In Wednesday's run, prizes have been claimed for Oracle Java by James Forshaw, Oracle Java again by Joshua Drake, IE10 on Windows 8 by VUPEN, Google Chrome on Windows 7 by a team from MWR Labs, John and Nils, and finally Mozilla Firefox and Oracle Java, both by the team at VUPEN," said Wolfgang Kandek, CTO at Qualys. "You can expect patches for these vulnerabilities to be released over the coming weeks."
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Microsoft/Windows
1.   BBM Now Available on Windows Phone
2.   Microsoft Spreads Cortana Abroad
3.   China Puts Microsoft Under the Lens
4.   Win Phone 8.1 Update Already on Way
5.   Yammer Moved to Office 365


advertisement
China Puts Microsoft Under the Lens
Official anti-monopoly probe launched.
Average Rating:
Microsoft CEO Sees 'Bold' Plan Ahead
With unified Windows for all platforms.
Average Rating:
Design Central to Microsoft Future
New ethos a break from functional past.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.