Microsoft on Tuesday issued 13 security bulletins. Only three were rated critical. That's a small reprieve since IT admins expected 14 bulletins -- the fix for the so-called Beast attack did not make it into this release.
December's Patch Tuesday brings Microsoft's total to 99 bulletins in 2011.
Joshua Talbot, security intelligence manager for Symantec Security Response, said the most important patch this month is the TrueType Font Parsing issue, which is the zero-day vulnerability exploited as part of the Duqu targeted attacks.
"The Duqu malware didn't actually incorporate an exploit for this issue in its code, but the vulnerability was used by malicious e-mail attachments to load Duqu onto targeted systems," he explained.
Symantec typically puts Internet Explorer cumulative updates pretty high on its priority list, Talbot added, but this month none of the IE vulnerabilities are particularly high-impact issues.
"They're still important, but we suggest prioritizing quite a few of the other bulletins ahead of them. For example, the Windows Media Player DVR-MS memory corruption issue," Talbot said. "This one looks pretty simple to exploit and can result in a complete system takeover. To make matters worse, [data execution prevention] and [address space layout randomization] only offer limited protection here."
No Out-of-Band Patches in 2011
Andrew Storms, director of security operations at nCircle, noted that it's been a long time since Microsoft pulled a bulletin at the last minute. Microsoft pulled the Beast fix because of a bad interaction with a high-profile vendor.
"This last minute change highlights the extensive testing Microsoft does during the patch releases. A bad patch makes for the worst sort of IT heartburn," Storms said. "I'm sure we'll see the 'Beast' bulletin in the January patch, and waiting a little longer for a fix shouldn't be much of an issue because it's fairly difficult to take advantage of this bug."
Although anything could happen in the next two weeks, Storms pointed out that Microsoft appears to have made it through 2011 without having to issue an out-of-band patch. In fact, he added, the year has been marked by lower severity ratings for all vulnerabilities.
"The new, improved risk mitigation technologies in Windows 7 and IE9 just might make out-of-band Microsoft patches a thing of the past," Storms said, "and that would be the best holiday gift Microsoft could give."
Total Patch Count Declines
Considering the previous years of Microsoft patches, this is not a bad way to end the year, said Paul Henry, a security and forensic analyst and blogger at Lumension. Microsoft released 17 bulletins in the 2010 December Patch Tuesday. Microsoft's total patch count, 99, is also down in 2011, from 106 in 2010.
"Clearly Microsoft has dramatically improved its software processes and this is reflected in the continued decline of vulnerabilities considered critical in the current codebase," Henry said. "The numbers speak volumes on the improvements from Microsoft. In 2006, 70 percent of security patches were critical and in 2011 critical vulnerabilities fell to just 30 percent. In an otherwise volatile threat landscape, this is good news for everyone."
Posted: 2011-12-30 @ 1:50am PT
Just when we thought that Microsoft did not release an out-of-band patch, on December 29, 2011, Microsoft released an out-of-band Security Bulletin MS11-100 to address the publicly disclosed denial-of-service issue described in Security Advisory 2659883. The maximum severity level of the bulletin is Critical.