Risk
7/9/2013
09:09 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft Patch Tuesday Fixes Six Critical Bugs

Microsoft issues patches for an unusual number of critical vulnerabilities that encompass the company's entire software ecosystem.

10 Hidden Benefits of Windows 8.1
10 Hidden Benefits of Windows 8.1
(click image for larger view)
Microsoft has been focusing on Windows 8 lately, but there are numerous versions of Windows in use and the company can't ignore them. On Tuesday, Microsoft will release an unusually high number of critical patches for almost all of them.

July's Patch Tuesday includes fixes for six critical flaws, all of which involve remote execution bugs that could allow attackers to take control of a user's machine. The affected platforms and software includes not only all currently-supported versions of Windows, but also all Internet Explorer versions from IE 6 onward, as well as Office, Lync, Visual Studio, Silverlightand Microsoft's .NET framework. If you use any Microsoft product from the last several years, in other words, you probably need at least some of the patches.

Two of the critical exploits require that machines be restarted. Some versions of Windows are more vulnerable than others without a given patch, meaning that some of the updates designated as "critical" overall are downgraded for specific platforms. Nonetheless, all versions of Windows are afflicted by multiple high-priority exploits.

[ Microsoft is moving more quickly to fix problems. Read Microsoft Releases First Windows 8.1 Fixes. ]

Microsoft has also prepared a seventh patch, which it classified as "important." It addresses a vulnerability in Windows Defender, the platform's pre-installed security software.

The large batch of critical fixes has raised eyebrows in the security community. In a blog post, Paul Ducklin, head of technology at security vendor Sophos, advised businesses to get their "operational ducks in a row," adding that the patches are unusually broad. Windows Server Core, for example, is usually excluded from Patch Tuesdays because its stripped-down feature set offers a "significantly reduced attack surface area." It's therefore notable that July's updates include a Windows Server Core 2012 reboot, Ducklin wrote.

Paul Henry, a security and forensic analyst at security tools firm Lumension, similarly told The Guardian that this month's patches constitute "one of the uglier releases we've seen from Microsoft this year." Graham Cluley, a senior technology consultant with Sophos, channeled the hacker vernacular to describe the threat, warning in a blog post to "patch before you're pwned."

IT managers, in short, should be on alert.

The updates are expected to address a somewhat controversial exploit reported in June by Google researcher Tavis Ormandy. Ormandy discovered a zero-day vulnerability linked to the kernel for all editions of Windows from Windows 2000 to the present. The Google researcher, who had previously criticized Microsoft as "difficult to work with" reported the bug privately but waited only a few days before publishing his findings online.

Some security professionals have cried foul, arguing that Ormandy's public disclosure was unethical because it left Microsoft too little time to develop a fix and, in effect, gave malware authors a dangerous head start.

Security firm Secunia determined that the bug is only semi-urgent. Still, the firm noted that attackers could use the vulnerability to gain escalated privileges, or to hijack a machine for a denial-of-service attack. Tod Beardsley, a security researcher with Metasploit, noted in a blog, however, that this sort of local exploit provides a foundation for more damaging attacks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.