Risk
12/13/2010
07:00 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Patch Tuesday: Too Big To Ignore?

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.

Any IT administrators hoping to get an early jump on the holidays this week face a big disappointment: 40 software updates coming from Redmond this month.According to Microsoft's advanced notification bulletin, December's Patch Tuesday will pack a whopping 40 patches detailed in 17 separate security bulletins.

Affected operating systems will include various flavors of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7. Various versions of Microsoft XP, Office 2003, Office 2007, and Office 2101. Microsoft Office Sharepoint Server 2007 doesn't escape either.

That's a serious line-up of flaws. However, according to this story from Mathew J. Schwartz, many companies may be planning to skip December and patch next month instead:

Expect enterprises to punt many of these patches until 2011. "The high number of advisories will present a challenge to all Windows system administrators, especially with the holidays shortening the available working hours," said Wolfgang Kandek, CTO of Qualys.

Bad plan.

All types of attackers bank of the fact that IT teams are unstaffed and over-partied during the holiday season. In fact, if your organization is being targeted expect an escalation of breach attempts during the holidays. The attackers know you are short staffed. They know your mind is elsewhere. And they know it's human nature to try to put off any absolutely unnecessary work until next year.

Don't be surprised to see a significant amount of exploit software and attacks targeting these vulnerabilities as we head closer to the new year.

So do yourself and your organization a favor: test and deploy these patches before shutting down for the year.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant