Microsoft on Tuesday issued 10
bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.
We caught up with Andrew Storms, director of security operations at Tripwire, to discuss the implications for IT. He told us the quick release of the Internet Explorer 8 patch, which fixes an outstanding zero-day bug reportedly used in a targeted watering hole attack against the US Department of Labor, is a good example of Microsoft's responsiveness to the security community and their users.
"In addition to the zero-day IE8 fix, Microsoft also released an additional security bulletin for Internet Explorer. All users will want to make installation of both patches top priority because browser-based bugs are always high value targets for attackers," Storms said. "For consumers, turning on auto-update is always the best course of action, especially for web browsers, because you will automatically be protected against these kinds of vulnerabilities as soon as a patch is available."
Denial of Service Bug
For all the talk about IE8, though, Storms said there's another patch to pay particular attention to this month. That patch fixes a denial of service bug in IIS, Microsoft's web server. He said there is good news and bad news surrounding this patch.
"The good news is that only Windows 2012 web servers are affected. All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages," Storms said
The bad news, he continued, is that a successful exploit of this bug could have serious implications for public web servers without some kind of inline IPS in front of them. Essentially, he noted, any user could launch a simple attack and the server will essentially be offline.
Microsoft Patch Volume Rising
Wolfgang Kandek, CTO of Qualys, told us that, overall, Microsoft bulletin counts are at least 25 percent higher than in the last couple of years, partly due to the company's decision to go to monthly updates for Internet Explorer.
"Still, it is somewhat surprising given that the market for private vulnerability disclosure seems to have gained structure quite a bit, and I would have expected it to absorb a good part of found vulnerabilities," he said. "Joseph Menn just published an excellent article on this subject over at Reuters -- "Special Report: U.S. cyberwar strategy stokes fear of blowback".
Kandek noted that Adobe is also coming out with updates for three of its products: Coldfusion; Flash; and Reader. The update to Coldfusion addresses a zero-day vulnerability that has an exploit in the wild. Adobe has given workaround instructions in APSA13-03.
Meanwhile, the Reader update contains fixes for 27 vulnerabilities and affects all versions of Reader supported and is rated critical and includes Adobe's fixes for the PWN2OWN vulnerabilities as well. Kandek said to patch this as soon as possible because Adobe Reader is frequently attacked with file-based exploits.