Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

4/14/2020
06:25 PM
100%
0%

Patch-a-Palooza: More Than 560 Flaws Fixed in a Single Day

Software vendors keep pushing patches to the same Tuesday once a month, or once a quarter, and the result can be overwhelming. Six enterprise software makers issued patches for 567 issues in April.

Information technology groups have their work cut out for them this month. 

On April 14, six makers of popular enterprise software — Microsoft, Oracle, SAP, Intel, Adobe, and VMware — issued patches for at least 567 software vulnerabilities. Oracle's Critical Patch Update for the month, which rolls up fixes into a single massive patch for each product, accounted for more than 70% of the patch load, addressing 405 new security vulnerabilities, according to the company. An analysis of Microsoft's April security bulletin found that the company closed 113 security vulnerabilities, while SAP, Intel, Adobe, and VMware accounted for another 49 issues.

Overall, the crowding of software fixes has turned the second Tuesday of the month — a day on which Microsoft has traditionally released patches for many years — into a deluge of work for IT groups, says Jake Kouns, CEO and co-founder of Risk Based Security, a vulnerability information and management firm.

"Patch Tuesday is all about making software updates more organized so that companies can assign resources because they know when [the patches] come out," he says. "With more and more companies piggybacking on that, it becomes a challenge. How many patches can you handle in one day?"

The massive patch load comes as companies continue to adjust to the vast majority of their employees working from home, a fact that means patching could cause significant headaches, especially if companies have not prepared a capability to efficiently push patches to workers' machines. 

"Given the shift to remote work for many organizations in combination with the current patch load from Oracle's update earlier this week and what looks like a backlog of patching, this looks like a busy month for many security teams," says Jonathan Cran, head of research at vulnerability management firm Kenna Security.

Oracle issued Critical Patch Updates (CPUs) for 26 different products, including issuing fixes for 74 vulnerabilities in its E-Business Suite and 56 vulnerabilities in its Fusion Middleware.  

Microsoft closed 113 security holes in Windows, Microsoft Office, the Internet Explorer and Edge browsers, and other apps and tools. Nineteen of the vulnerabilities were rated Critical, 96 Important, five Moderate, and two Low, with nine issues rated differently, depending on the platform. One flaw, CVE 2020-0796, is a remote code execution vulnerability and is currently being used in active attacks, according to Kenna Security.

SAP patched 33 flaws, five of which were given a Common Vulnerability Scoring System rating of 9 or higher. Finally, Intel closed 9 issues in different firmware and software components, Adobe shuttered five security weaknesses, and VMware fixed two issues.

For companies that have moved to remote patch management, the workload should be manageable. Yet many companies were taken by surprise by the need to move employees to remote working, and the sheer number of fixes that need to be deployed this month could cause problems, says AJ Singh, co-founder and vice president of product at NinjaRMM, a remote monitoring and management service. 

"It is definitely a bigger hassle," he says. "And if there is a bad patch that causes issues, companies may have to put boots on the ground to actually fix the devices."

Even without the need to work during a pandemic, the move of many companies to release patches on the same day as Microsoft's original Patch Tuesday may be hurting customers more than helping them. 

Overall, the number of vulnerabilities released annually has more than doubled in the past three years. While that has largely been driven by the fact that more vulnerability reports are issued for a wider variety of products, the number of vulnerabilities released on peak days has also increased, according to Risk Based Security, which calls this perfect storm a Fujiwhara Event.

"I think it does make it more difficult," says Risk Based Security's Kouns. "Most companies — those that are dealing with remote patching before — won't have a problem. But for companies who when you ask, 'why did you adopt cloud?' and they answer, 'because of COVID' — they are going to have problems."

Related Content

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14499
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
CVE-2020-14501
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also ...
CVE-2020-14503
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
CVE-2020-14497
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
CVE-2020-14505
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection�) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that create...