Risk
12/13/2010
07:00 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Patch Tuesday: Too Big To Ignore?

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.According to Microsoft's advanced notification bulletin, December's Patch Tuesday will pack a whopping 40 patches detailed in 17 separate security bulletins.

Affected operating systems will include various flavors of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7. Various versions of Microsoft XP, Office 2003, Office 2007, and Office 2101. Microsoft Office Sharepoint Server 2007 doesn't escape either.

That's a serious line-up of flaws. However, according to this story from Mathew J. Schwartz, many companies may be planning to skip December and patch next month instead:

Expect enterprises to punt many of these patches until 2011. "The high number of advisories will present a challenge to all Windows system administrators, especially with the holidays shortening the available working hours," said Wolfgang Kandek, CTO of Qualys.

Bad plan.

All types of attackers bank of the fact that IT teams are unstaffed and over-partied during the holiday season. In fact, if your organization is being targeted expect an escalation of breach attempts during the holidays. The attackers know you are short staffed. They know your mind is elsewhere. And they know it's human nature to try to put off any absolutely unnecessary work until next year.

Don't be surprised to see a significant amount of exploit software and attacks targeting these vulnerabilities as we head closer to the new year.

So do yourself and your organization a favor: test and deploy these patches before shutting down for the year.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4734
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVE-2014-4960
Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

CVE-2014-5016
Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

CVE-2014-5017
Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

CVE-2014-5018
Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.