Vulnerabilities / Threats
11/9/2012
02:16 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Windows 8, RT Get First Security Fixes

Microsoft's first set of Windows 8 and Windows RT patches for critical vulnerabilities hits next week.

Microsoft Pop-Up Stores: Hands-On Look
Microsoft Pop-Up Stores: Hands-On Look
(click image for larger view and for slideshow)
Windows 8 and Windows RT, released just two weeks ago, are about to receive their first security makeover.

Microsoft on Thursday said that it plans to release its first security patches for Windows 8 and Windows RT as part of its monthly patch cycle next week.

Six security bulletins are scheduled for release, addressing a total of 19 vulnerabilities. Three of the bulletins apply to Windows 8, each of which has been designated critical. Two of the bulletins apply to Windows RT, one of which is critical.

Microsoft won't disclose specifics about the flaws until the patch is released to the public, but the Windows 8 vulnerabilities all allow remote code execution. One of them also affects Microsoft .NET Framework.

[ Get expert guidance on Microsoft Windows 8. InformationWeek's Windows 8 Super Guide rounds up the key news, analysis, and reviews that you need. ]

Other Microsoft software affected includes Windows XP, Windows Vista, Windows 7, Server 2003, Server 2008, and Server 2012. Also affected are Microsoft Internet Explorer 9; Microsoft Excel 2003, 2007, 2010; Microsoft Office for Mac 2008, 2011; Microsoft Excel Viewer; and Microsoft Office Compatibility Pack.

With regard to the two Windows RT vulnerabilities, both the critical one and the important one could allow remote code execution. Users who have chosen to enable automatic updating will receive the patches, as might be expected, automatically.

Versions of Internet Explorer prior to IE9 are not being patched. Neither is IE10, which ships with Windows 8 and Windows RT.

That doesn't mean IE10 is not without potential problems: On October 30, French security firm VUPEN claimed that it had identified a vulnerability affecting Windows 8 and Internet Explorer 10. Unfortunately for Microsoft customers, VUPEN sells information about the vulnerabilities it finds to its clients rather than disclosing the information to Microsoft or the public.

Upgrading isn't the easy decision that Win 7 was. We take a close look at Server 2012, changes to mobility and security, and more in the new Here Comes Windows 8 issue of InformationWeek. Also in this issue: Why you should have the difficult conversations about the value of OS and PC upgrades before discussing Windows 8. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
11/17/2012 | 6:30:25 PM
re: Windows 8, RT Get First Security Fixes
Why not just bundle the IE updates along with the other patches? Glad to see the at least they are keeping the Windows updates up to par. I foresee users unhappy who are running Windows 8, and unaware of the IE updates and vulnerabilities due to not receiving them.

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice post
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1950
Published: 2015-07-01
IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.

CVE-2015-1951
Published: 2015-07-01
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.

CVE-2015-1967
Published: 2015-07-01
MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.

CVE-2014-9734
Published: 2015-06-30
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

CVE-2014-9735
Published: 2015-06-30
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin a...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report