Risk
12/13/2010
07:00 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Patch Tuesday: Too Big To Ignore?

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.According to Microsoft's advanced notification bulletin, December's Patch Tuesday will pack a whopping 40 patches detailed in 17 separate security bulletins.

Affected operating systems will include various flavors of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7. Various versions of Microsoft XP, Office 2003, Office 2007, and Office 2101. Microsoft Office Sharepoint Server 2007 doesn't escape either.

That's a serious line-up of flaws. However, according to this story from Mathew J. Schwartz, many companies may be planning to skip December and patch next month instead:

Expect enterprises to punt many of these patches until 2011. "The high number of advisories will present a challenge to all Windows system administrators, especially with the holidays shortening the available working hours," said Wolfgang Kandek, CTO of Qualys.

Bad plan.

All types of attackers bank of the fact that IT teams are unstaffed and over-partied during the holiday season. In fact, if your organization is being targeted expect an escalation of breach attempts during the holidays. The attackers know you are short staffed. They know your mind is elsewhere. And they know it's human nature to try to put off any absolutely unnecessary work until next year.

Don't be surprised to see a significant amount of exploit software and attacks targeting these vulnerabilities as we head closer to the new year.

So do yourself and your organization a favor: test and deploy these patches before shutting down for the year.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1701
Published: 2015-04-21
Unspecified vulnerability in Microsoft Windows before 8 allows local users to gain privileges via unknown vectors, as exploited in the wild in April 2015.

CVE-2015-2041
Published: 2015-04-21
net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-2042
Published: 2015-04-21
net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-0702
Published: 2015-04-20
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.

CVE-2015-0703
Published: 2015-04-20
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.