Risk
12/13/2010
07:00 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Patch Tuesday: Too Big To Ignore?

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.According to Microsoft's advanced notification bulletin, December's Patch Tuesday will pack a whopping 40 patches detailed in 17 separate security bulletins.

Affected operating systems will include various flavors of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7. Various versions of Microsoft XP, Office 2003, Office 2007, and Office 2101. Microsoft Office Sharepoint Server 2007 doesn't escape either.

That's a serious line-up of flaws. However, according to this story from Mathew J. Schwartz, many companies may be planning to skip December and patch next month instead:

Expect enterprises to punt many of these patches until 2011. "The high number of advisories will present a challenge to all Windows system administrators, especially with the holidays shortening the available working hours," said Wolfgang Kandek, CTO of Qualys.

Bad plan.

All types of attackers bank of the fact that IT teams are unstaffed and over-partied during the holiday season. In fact, if your organization is being targeted expect an escalation of breach attempts during the holidays. The attackers know you are short staffed. They know your mind is elsewhere. And they know it's human nature to try to put off any absolutely unnecessary work until next year.

Don't be surprised to see a significant amount of exploit software and attacks targeting these vulnerabilities as we head closer to the new year.

So do yourself and your organization a favor: test and deploy these patches before shutting down for the year.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2849
Published: 2015-07-07
SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.

CVE-2015-2850
Published: 2015-07-07
Cross-site scripting (XSS) vulnerability in index-login.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

CVE-2015-3216
Published: 2015-07-07
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establi...

CVE-2014-3653
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVE-2014-5406
Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report