News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
You are here: Home / Enterprise I.T. / Sept. Patch Tuesday One To Remember
Gartner's #1 for endpoint backup
Sept. Patch Tuesday One To Remember, With 13 Bulletins
Sept. Patch Tuesday One To Remember, With 13 Bulletins
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
SEPTEMBER
11
2013


Microsoft on Tuesday issued 13 security bulletins. Four are rated critical. The cumulative 47 patches address vulnerabilities in Microsoft Windows, Office, Outlook, Internet Explorer and SharePoint. Microsoft recommends focusing on MS13-067, MS13-068, and MS13-069 first.

"While the Outlook bulletin is certainly one to pay attention to, building a reliable exploit for this issue won't be easy," said Dustin Childs, group manager, Microsoft Trustworthy Computing. "Still, we've listed this update as one of our highest priorities for this month and encourage customers to deploy the bulletins to help ensure protection."

2004 Risks Real Again

Microsoft is putting top priority on MS13-067, which affects SharePoint Server. The most severe vulnerability is CVE-2013-1330, which allows remote code execution by malicious content sent to the server without user interaction, genuine real-time remote exploitation, said Ross Barrett, a senior manager of security engineering at Rapid 7.

"Of the 10 CVEs, one is public, but supposedly that is not CVE-2013-1330," he told us. "There is a workaround for CVE-2013-1330 related to enabling state inspection for message authentication code attributes."

The other two critical advisories require user interaction to trigger the vulnerabilities. However, Barrett noted that MS13-068 affecting Microsoft Outlook is particularly toxic because it can be triggered when users view malicious content in the Outlook preview pane.

"Apparently, we have gone back in time and the risks from 2004 are real again," he said. "This is pretty significant and administrators will have to move fast to patch this before exploits appear."

SharePoint Shops Beware

MS13-070 is concerning to Barrett because it only applies to XP and Server 2003, and those vulnerabilities tend to be less "contained" than more mature versions of Windows.

"If you are running an MS-heavy shop and have significantly invested in the back office technology of SharePoint and all its glorious services, then this month is going to be very busy for you," he said.

"There are lots of vulnerabilities to patch, many of which are high risk. Office vulnerabilities are typically mitigated by the fact that they require a user to interact with something malicious, either through an attachment or a link, in order to be exploited. But with the SharePoint that degree of mitigation may go away and other factors of defense-in-depth will come into play."

The Hardest Hit

We turned to Paul Henry, a security and forensics analyst at Lumension, to get his take on this month's Patch Tuesday. He told us this is definitely a September to remember. By way of comparison, September 2012's release only contained two bulletins -- and both were rated as important.

"We're seeing big numbers this month but there is perhaps some good news: only four patches are considered critical, two were publicly known yet Microsoft has not seen active attacks on any of the September CVEs to-date and none of them impact the current code base," Henry said.

IE, SharePoint and Outlook are hardest hit this month, Henry said, and vulnerabilities in XP and Windows 2003 were also patched -- a practice he hopes to see more of as the XP end-of-life date of April 8, 2014, nears. Windows 2003 has an end-of-life date of July 14, 2015. For anyone using XP, he said, a migration plan should be put in place if you do not already have one.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
AdvertisementToday's CIO needs to adopt an "Everyone's IT" approach to leadership, embracing technology to increase enterprise agility & collaboration. View the free Gartner research report to learn how to adapt your IT leadership style to today's business standards.
MORE IN ENTERPRISE I.T.
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Dairy Queen Latest Retailer To Report Hack
Dairy Queen is known for its hot fries and sweet treats, but it just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 

Enterprise Hardware Spotlight
HP Previews ProLiant Gen9 Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 
Alert: HP Recalls 5 Million Notebook AC Power Cords
HP is recalling about 5.6 million notebook computer AC power cords in the U.S. and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.
 

Mobile Technology Spotlight
Apple Sets Sept. 9 Event: iPhone 6, iWatch on Tap?
Save the date. Apple formally announced that its long-anticipated “special event," will take place on September 9. Does the tech giant have the iPhone 6, and the iWatch up its sleeve?
 
Samsung's New Smart Watch Makes Calls Without Phone
Following up on the Gear 2, Samsung has unveiled a new 3G smart watch, the Gear S, that stands out in its ability to make phone calls and send text messages without a smartphone.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.