Vulnerabilities / Threats

8/10/2010
02:28 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Issues Biggest Security Patch Yet

IT administrators have plenty of work to do if they want to close up the holes in their systems.

Microsoft on Tuesday released a record-setting security patch consisting of 14 bulletins that address 34 vulnerabilities.

Eight of the bulletins are rated "critical" and six are rated "important."

Affected software includes: Microsoft Office, Microsoft Windows, Microsoft Internet Explorer, Microsoft Silverlight, Microsoft XML Core Services and Server Message Block.

In addition, Microsoft is releasing a new security advisory for a privilege escalation vulnerability that affects its Windows Service Isolation feature.

The massive patch is the largest since October, 2009, when Microsoft issued 13 security bulletins covering 34 vulnerabilities.

MS10-046 would bring the total to 15 bulletins but for the fact that it was issued out-of-band last week to provide a fix for a 0-day flaw in LNK files. The vulnerability is currently being exploited by the Stuxnet family of malware.

Wolfgang Kandek, CTO of Qualys, advises IT administrators to patch the vulnerabilities that affect end users and Internet browsing first.

These include: MS10-053, six fixes for Internet Explorer; MS10-055, a Cinepak code vulnerability; MS10-052, a vulnerability in Microsoft's MPEG Layer-3 audio codecs; MS10-060, a vulnerability affecting Silverlight and .Net; MS10-051, a vulnerability in the Internet Explorer MSXML ActiveX component; and MS10-049, a client side HTTPS vulnerability.

The first five of these are all have an Explotability Rating of "1"; the sixth, MS10-049, has an Explotability Rating of "2".

MS10-054 addresses a vulnerability in the SMB protocol.

Joshua Talbot, security intelligence manager for Symantec Security Response, argues that this should be of particular concern to enterprises.

"Not only does it give an attacker system-level access to a compromised SMB server, but the vulnerability occurs before authentication is required from computers contacting the server," he said in an e-mail. "This means any system allowing remote access and not protected by a firewall is at risk."

Josh Abraham, security researcher for Rapid7, concurs, noting in an e-mail that the SMB vulnerability "is potentially the most dangerous vulnerability as it allows unauthenticated attackers to execute arbitrary code on remote machines."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11403
PUBLISHED: 2018-05-24
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
CVE-2018-11404
PUBLISHED: 2018-05-24
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
CVE-2018-11405
PUBLISHED: 2018-05-24
Kliqqi 2.0.2 has CSRF in admin/admin_users.php.
CVE-2018-11410
PUBLISHED: 2018-05-24
An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2018-11399
PUBLISHED: 2018-05-24
SimpliSafe Original has Unencrypted Sensor Transmissions, which allows physically proximate attackers to obtain potentially sensitive information about the specific times when alarm-system events occur.