Vulnerabilities / Threats
11/9/2012
02:16 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Windows 8, RT Get First Security Fixes

Microsoft's first set of Windows 8 and Windows RT patches for critical vulnerabilities hits next week.

Microsoft Pop-Up Stores: Hands-On Look
Microsoft Pop-Up Stores: Hands-On Look
(click image for larger view and for slideshow)
Windows 8 and Windows RT, released just two weeks ago, are about to receive their first security makeover.

Microsoft on Thursday said that it plans to release its first security patches for Windows 8 and Windows RT as part of its monthly patch cycle next week.

Six security bulletins are scheduled for release, addressing a total of 19 vulnerabilities. Three of the bulletins apply to Windows 8, each of which has been designated critical. Two of the bulletins apply to Windows RT, one of which is critical.

Microsoft won't disclose specifics about the flaws until the patch is released to the public, but the Windows 8 vulnerabilities all allow remote code execution. One of them also affects Microsoft .NET Framework.

[ Get expert guidance on Microsoft Windows 8. InformationWeek's Windows 8 Super Guide rounds up the key news, analysis, and reviews that you need. ]

Other Microsoft software affected includes Windows XP, Windows Vista, Windows 7, Server 2003, Server 2008, and Server 2012. Also affected are Microsoft Internet Explorer 9; Microsoft Excel 2003, 2007, 2010; Microsoft Office for Mac 2008, 2011; Microsoft Excel Viewer; and Microsoft Office Compatibility Pack.

With regard to the two Windows RT vulnerabilities, both the critical one and the important one could allow remote code execution. Users who have chosen to enable automatic updating will receive the patches, as might be expected, automatically.

Versions of Internet Explorer prior to IE9 are not being patched. Neither is IE10, which ships with Windows 8 and Windows RT.

That doesn't mean IE10 is not without potential problems: On October 30, French security firm VUPEN claimed that it had identified a vulnerability affecting Windows 8 and Internet Explorer 10. Unfortunately for Microsoft customers, VUPEN sells information about the vulnerabilities it finds to its clients rather than disclosing the information to Microsoft or the public.

Upgrading isn't the easy decision that Win 7 was. We take a close look at Server 2012, changes to mobility and security, and more in the new Here Comes Windows 8 issue of InformationWeek. Also in this issue: Why you should have the difficult conversations about the value of OS and PC upgrades before discussing Windows 8. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
PJS880
50%
50%
PJS880,
User Rank: Ninja
11/17/2012 | 6:30:25 PM
re: Windows 8, RT Get First Security Fixes
Why not just bundle the IE updates along with the other patches? Glad to see the at least they are keeping the Windows updates up to par. I foresee users unhappy who are running Windows 8, and unaware of the IE updates and vulnerabilities due to not receiving them.

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.