HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED ABOUT A MINUTE AGO.
You are here: Home / Network Security / Number of Microsoft Patches Rising
Neustar, Inc.
Protect your website & network using real-time information & analysis
www.neustar.biz
Microsoft Security Patches Rolling Hard and Fast in 2013
Microsoft Security Patches Rolling Hard and Fast in 2013
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
MARCH
13
2013
Just three months into 2013, and a disturbing trend is manifesting at Microsoft: There are a higher number of patches -- and, particularly, critical patches.

In 2012 Microsoft was averaging seven patches, only two of which were critical, each Patch Tuesday. In 2013, Microsoft is averaging close to nine patches monthly, including four critical fixes.

"To really put things in perspective, by March of 2011, Microsoft was averaging close to six patches, with around one critical patch," said Paul Henry, a security and forensic analyst at Lumension. "We can only hope that this increase is due to a combination of new platforms and better discovery of vulnerabilities, rather than actual ongoing security problems at Microsoft."

Top Three Priorities

Microsoft on Tuesday issued seven patches, four rated critical. As Henry sees it, the priority is MS13-021, which is a critical patch for Internet Explorer, addressing nine vulnerabilities. Fortunately, he said, none of these "use after free" issues are being publicly exploited.

"Use after free" is receiving more attention recently. However, he emphasized that it's not the delivery mechanism that's a problem. The problem is not taking care of the end game: preventing unauthorized binary from running on your machine in the first place.

"MS13-022 is your second priority. It's a critical update for a remote code execution issue in Silverlight 5. This browse-and-own attack is a pretty standard one, where users might browse to a Web site that has malicious content," Henry said.

"MS13-027 should be your third priority for patching this month, even though it's ranked important by Microsoft because it requires physical access to pull off. Regardless, it's a pretty scary vulnerability. This is an elevation of privilege in kernel mode drivers. Normally, with this sort of vulnerability, a low-level authorized user might be elevated to the system level. However, this one is a little different."

Just Like in the Movies

Andrew Storms, director of security operations at nCircle, agrees that MS13-027 is a serious vulnerability. It allows anyone with a USB stick loaded with attack code and physical access to a computer to subvert security controls. If these conditions are met, he explained, the attack would be successful even if auto-run was disabled and the screen was locked.

"You've seen this attack method in movies for years, and it's now showing in enterprises all over the world," Storms said. "Just imagine what a properly motivated janitorial staff could do with this vulnerability in just one evening. This vulnerability also seriously impacts security on all those public kiosks and co-location centers that don't have locked cabinets. The potential for harm with this vulnerability can't be overstated."

The good news is you don't need to put glue in your USB ports to protect yourself, he said. Either install the patch ASAP, or deploy a Group Policy Object setting to temporarily disable USB ports until the patch is completely deployed.

An Office-Heavy Month

Tyler Reguly, technical manager of security research and development at nCircle, calls March an "Office-heavy" month. The release includes patches for OneNote, Visio and Office for Mac.

"It's interesting that none of the core Office products are patched -- I suspect we'll see them next month," he said. "Today's top priority is the usual suspect, Internet Explorer. This has started to become routine and I'll be more surprised when we have a month where it's not at the top of the list."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Enterprise Endpoint Backup - What You Need to Know and Why: Access this must-read report that IT leaders and their peers are referencing to narrow down their backup shortlist. Gartner rates the key capabilities for endpoint backup for both mobile and office-centric workforces, from data protection to security risk reduction, and increased user productivity. Access the Report Now.
MORE IN NETWORK SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.