Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Mobile Tech
Next Generation Data Center Is Here!
Average Rating:
Rate this article:  
Microsoft Patch Tuesday To Bring Heavy Office Emphasis
Microsoft Patch Tuesday To Bring Heavy Office Emphasis

By Jennifer LeClaire
March 8, 2013 10:56AM

    Bookmark and Share
"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," said security expert Ross Barrett about Microsoft's next Patch Tuesday. Of the seven security fixes Microsoft is releasing for Patch Tuesday, four are rated as critical.
 



Call it March Madness. Microsoft on Tuesday will roll out seven security bulletins. Four of the bulletins are rated critical and three are rated important -- and some require restarts.

The critical bulletins affect Microsoft Windows, Silverlight for Office, and Microsoft Server software. The other bulletins aim to fix vulnerabilities in Office and Windows.

"IT admins can't seem to catch a break this year. First, the never-ending stream of Java issues that has kept folks on their toes since January," said Paul Henry, a security and forensic analyst at Lumension. "Now they've got another busy month of patches ahead of them, with seven total patches from Microsoft, four of which are critical. However, once again the issues outside of Microsoft will likely eclipse the Patch Tuesday issues this month."

A Heavy Office Focus

Ross Barrett, senior manager of security engineering at Rapid 7, told us it was interesting that Bulletin 1 does not list Internet Explorer 10 on Windows 7 as vulnerable. It may be an omission, he said, or it may be that the fix was included when IE 10 was released for Windows 7 systems last week. Regardless, he said, this is where he would prioritize his patching efforts.

"From this vantage, my gut feel is that Bulletin 3 is the second most important to patch, followed by either of the two other critical issues," Barrett said. "The information disclosure issues in Office I would patch when it isn't going to impact your users in any way. One of them, at least, will not require a restart."

Barrett also pointed to Bulletin 4, which is only an "elevation of privilege" vulnerability. Still, he said, it's listed as critical. That may mean that it is remotely exploitable with a known user name, or that it is already being exploited in the wild.

Meanwhile, Bulletin 2 is listed as critical in Silverlight, which is interesting to Barrett since Silverlight is not among Microsoft's most popular apps. He suggested users who have installed Silverlight should deploy this patch quickly since the risk would be on par with a Flash vulnerability.

"The focus has changed direction from last month, where Office wasn't addressed, to four of seven advisories this month relating to Office," Barrett said. "It seems likely that the seventh bulletin is another Windows kernel or kernel driver issue, since it is a core operating system vulnerability, requires a restart, and the risk is elevation of privilege."

PWN2OWN Results

In other security news, the ZDI's PWN2OWN competition is going on at the CanSecWest security conference in Vancouver. PWN2OWN awards prizes ranging from $20,000 to $100,000 to security researchers that demonstrate vulnerabilities in Adobe Flash, Adobe Reader, Google Chrome, Internet Explorer, Firefox and Java.

"In Wednesday's run, prizes have been claimed for Oracle Java by James Forshaw, Oracle Java again by Joshua Drake, IE10 on Windows 8 by VUPEN, Google Chrome on Windows 7 by a team from MWR Labs, John and Nils, and finally Mozilla Firefox and Oracle Java, both by the team at VUPEN," said Wolfgang Kandek, CTO at Qualys. "You can expect patches for these vulnerabilities to be released over the coming weeks."
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Mobile Tech
1.   BBM Now Available on Windows Phone
2.   Virgin Mobile Offers Custom Plans
3.   Asana Revamps Mobile App
4.   Android 'Fake ID' Puts Millions at Risk
5.   FTC Wants Fix for Mobile Cramming


advertisement
Android 'Fake ID' Puts Millions at Risk
Users: stick to apps from Google Play.
Average Rating:
Dell, BlackBerry Downplay Threat
Say Apple-IBM alliance can't hurt them.
Average Rating:
BlackBerry Acquires Secusmart
German security firm offers street cred.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
New 'Backoff' Malware Slips Undetected into Retail Systems
'Malicious actors' are using a new variety of malware to access consumer payment data remotely through point-of-sale systems, according to a report from the Department of Homeland Security.
 
IBM Beefs Up Identity Intelligence Security Solutions
Big Blue is betting big on identity intelligence. IBM just acquired a private firm with security software to govern user access to apps and data across cloud and on-premise environments.
 
USB Security Flaw Lets Hackers Hijack PCs
Hackers can use the firmware that controls USB functions to take control of computers, say security experts. That means there may be a new class of attack for which there are no defenses.
 

Enterprise Hardware Spotlight
AMD's ARM-Based Opteron Out in $3K Dev Kit
It's dubbed "Seattle" and it's AMD's first 64-bit ARM-based Opteron processor. The low-power chip is being released as part of AMD’s Opteron A1100-series developer kit, and aimed at high-end data center needs.
 
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 

Mobile Technology Spotlight
BlackBerry Messenger Now Available on Windows Phone
BlackBerry's free Messenger chatting and voice app is out of beta and widely available for Windows Phone users, the company said. BBM offers secure messaging, Groups, Voice, Channels and more.
 
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.