Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Network Security
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
Patch Tuesday Hyper Focuses on IE 8

Patch Tuesday Hyper Focuses on IE 8
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

"The good news is that only Windows 2012 web servers are affected," explained security expert Andrew Storms. "All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages."
 

Related Topics

Patch
Security
Microsoft
Zero-day


Microsoft on Tuesday issued 10 security bulletins that fix 33 vulnerabilities. These updates include MS13-038, which will address the Internet Explorer 8 issue described in Security Advisory 2847140.

We caught up with Andrew Storms, director of security operations at Tripwire, to discuss the implications for IT. He told us the quick release of the Internet Explorer 8 patch, which fixes an outstanding zero-day bug reportedly used in a targeted watering hole attack against the US Department of Labor, is a good example of Microsoft's responsiveness to the security community and their users.

"In addition to the zero-day IE8 fix, Microsoft also released an additional security bulletin for Internet Explorer. All users will want to make installation of both patches top priority because browser-based bugs are always high value targets for attackers," Storms said. "For consumers, turning on auto-update is always the best course of action, especially for web browsers, because you will automatically be protected against these kinds of vulnerabilities as soon as a patch is available."

Denial of Service Bug

For all the talk about IE8, though, Storms said there's another patch to pay particular attention to this month. That patch fixes a denial of service bug in IIS, Microsoft's web server. He said there is good news and bad news surrounding this patch.

"The good news is that only Windows 2012 web servers are affected. All IT security teams should be jumping on this quickly, as an exploit is likely to be developed very quickly. A successful exploit could cause a DoS on affected servers, creating temporary outages," Storms said

The bad news, he continued, is that a successful exploit of this bug could have serious implications for public web servers without some kind of inline IPS in front of them. Essentially, he noted, any user could launch a simple attack and the server will essentially be offline.

Microsoft Patch Volume Rising

Wolfgang Kandek, CTO of Qualys, told us that, overall, Microsoft bulletin counts are at least 25 percent higher than in the last couple of years, partly due to the company's decision to go to monthly updates for Internet Explorer.

"Still, it is somewhat surprising given that the market for private vulnerability disclosure seems to have gained structure quite a bit, and I would have expected it to absorb a good part of found vulnerabilities," he said. "Joseph Menn just published an excellent article on this subject over at Reuters -- "Special Report: U.S. cyberwar strategy stokes fear of blowback".

Kandek noted that Adobe is also coming out with updates for three of its products: Coldfusion; Flash; and Reader. The update to Coldfusion addresses a zero-day vulnerability that has an exploit in the wild. Adobe has given workaround instructions in APSA13-03.

Meanwhile, the Reader update contains fixes for 27 vulnerabilities and affects all versions of Reader supported and is rated critical and includes Adobe's fixes for the PWN2OWN vulnerabilities as well. Kandek said to patch this as soon as possible because Adobe Reader is frequently attacked with file-based exploits.
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Network Security
1.   UPS Stores Hit by Data Breach
2.   Target Data Breach Cost: $148 Million
3.   Aruba Handles Black Hat with Aplomb
4.   Chinese Hackers Steal Patient Data
5.   FBI Cybersquad To Add Agents


advertisement
Aruba Handles Black Hat with Aplomb
Network firm sees 2,376 DoS attacks.
Average Rating:
UPS Stores Hit by Data Breach
Biz must adopt better security measures.
Average Rating:
Target Data Breach Cost: $148 Million
Better customer data protection needed.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Mobile Technology Spotlight
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 
Samsung, B&N Target Amazon with Nook Tablet
They've seen the enemy and it is Amazon. So Samsung and Barnes & Noble are teaming up to combat their common foe with a 7-inch tablet that blends Samsung’s tech, Nook’s content and e-reader platform.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.