Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Network Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Patch Tuesday Hyper Focuses on IE 8
Patch Tuesday Hyper Focuses on IE 8

By Jennifer LeClaire
May 14, 2013 3:40PM

    Bookmark and Share
"The good news is that only Windows 2012 web servers are affected," explained security expert Andrew Storms. "All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages."
 

Related Topics

Patch
Security
Microsoft
Zero-day



Microsoft on Tuesday issued 10 security bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.

We caught up with Andrew Storms, director of security operations at Tripwire, to discuss the implications for IT. He told us the quick release of the Internet Explorer 8 patch, which fixes an outstanding zero-day bug reportedly used in a targeted watering hole attack against the US Department of Labor, is a good example of Microsoft's responsiveness to the security community and their users.

"In addition to the zero-day IE8 fix, Microsoft also released an additional security bulletin for Internet Explorer. All users will want to make installation of both patches top priority because browser-based bugs are always high value targets for attackers," Storms said. "For consumers, turning on auto-update is always the best course of action, especially for web browsers, because you will automatically be protected against these kinds of vulnerabilities as soon as a patch is available."

Denial of Service Bug

For all the talk about IE8, though, Storms said there's another patch to pay particular attention to this month. That patch fixes a denial of service bug in IIS, Microsoft's web server. He said there is good news and bad news surrounding this patch.

"The good news is that only Windows 2012 web servers are affected. All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages," Storms said

The bad news, he continued, is that a successful exploit of this bug could have serious implications for public web servers without some kind of inline IPS in front of them. Essentially, he noted, any user could launch a simple attack and the server will essentially be offline.

Microsoft Patch Volume Rising

Wolfgang Kandek, CTO of Qualys, told us that, overall, Microsoft bulletin counts are at least 25 percent higher than in the last couple of years, partly due to the company's decision to go to monthly updates for Internet Explorer.

"Still, it is somewhat surprising given that the market for private vulnerability disclosure seems to have gained structure quite a bit, and I would have expected it to absorb a good part of found vulnerabilities," he said. "Joseph Menn just published an excellent article on this subject over at Reuters -- "Special Report: U.S. cyberwar strategy stokes fear of blowback".

Kandek noted that Adobe is also coming out with updates for three of its products: Coldfusion; Flash; and Reader. The update to Coldfusion addresses a zero-day vulnerability that has an exploit in the wild. Adobe has given workaround instructions in APSA13-03.

Meanwhile, the Reader update contains fixes for 27 vulnerabilities and affects all versions of Reader supported and is rated critical and includes Adobe's fixes for the PWN2OWN vulnerabilities as well. Kandek said to patch this as soon as possible because Adobe Reader is frequently attacked with file-based exploits.
 

Tell Us What You Think
Comment:

Name:



Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.


 Network Security
1.   Chinese Hackers Hit U.S. Officials
2.   Russian Hacker's Charges Revealed
3.   Another IE-Focused Patch Tuesday
4.   Russian Arrested in Hacking Case
5.   Most Networks Not Ready for IoT


advertisement
Android SMS Worm on the Loose
Malware lets bad actors cash in.
Average Rating:
Another IE-Focused Patch Tuesday
One critical for Internet Explorer.
Average Rating:
Most Networks Not Ready for IoT
But most enterprises are prepared.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Report: Chinese Hackers Hit U.S. Personnel Networks
Hackers from China broke into the computer networks of the U.S. Office of Personnel Management earlier this year with the intention of accessing the files of tens of thousands of federal employees.
 
Charges: Russian Stole Data from U.S. Restaurants, Zoo
A Russian man arrested on bank fraud and other charges hacked into computers at restaurants in Washington, hundreds of other retail businesses, and even the Phoenix Zoo, authorities say.
 
Another Month, Another IE-Focused Patch Tuesday
Microsoft rolled out 59 vulnerabilities for Internet Explorer in June. But the IE-patching party is not over yet. Redmond published six new security bulletins on Tuesday; two, critical; three, important.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.