Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/10/2010
02:28 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Issues Biggest Security Patch Yet

IT administrators have plenty of work to do if they want to close up the holes in their systems.

Microsoft on Tuesday released a record-setting security patch consisting of 14 bulletins that address 34 vulnerabilities.

Eight of the bulletins are rated "critical" and six are rated "important."

Affected software includes: Microsoft Office, Microsoft Windows, Microsoft Internet Explorer, Microsoft Silverlight, Microsoft XML Core Services and Server Message Block.

In addition, Microsoft is releasing a new security advisory for a privilege escalation vulnerability that affects its Windows Service Isolation feature.

The massive patch is the largest since October, 2009, when Microsoft issued 13 security bulletins covering 34 vulnerabilities.

MS10-046 would bring the total to 15 bulletins but for the fact that it was issued out-of-band last week to provide a fix for a 0-day flaw in LNK files. The vulnerability is currently being exploited by the Stuxnet family of malware.

Wolfgang Kandek, CTO of Qualys, advises IT administrators to patch the vulnerabilities that affect end users and Internet browsing first.

These include: MS10-053, six fixes for Internet Explorer; MS10-055, a Cinepak code vulnerability; MS10-052, a vulnerability in Microsoft's MPEG Layer-3 audio codecs; MS10-060, a vulnerability affecting Silverlight and .Net; MS10-051, a vulnerability in the Internet Explorer MSXML ActiveX component; and MS10-049, a client side HTTPS vulnerability.

The first five of these are all have an Explotability Rating of "1"; the sixth, MS10-049, has an Explotability Rating of "2".

MS10-054 addresses a vulnerability in the SMB protocol.

Joshua Talbot, security intelligence manager for Symantec Security Response, argues that this should be of particular concern to enterprises.

"Not only does it give an attacker system-level access to a compromised SMB server, but the vulnerability occurs before authentication is required from computers contacting the server," he said in an e-mail. "This means any system allowing remote access and not protected by a firewall is at risk."

Josh Abraham, security researcher for Rapid7, concurs, noting in an e-mail that the SMB vulnerability "is potentially the most dangerous vulnerability as it allows unauthenticated attackers to execute arbitrary code on remote machines."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19750
PUBLISHED: 2019-12-12
minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.
CVE-2019-4606
PUBLISHED: 2019-12-12
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-For...
CVE-2019-16246
PUBLISHED: 2019-12-12
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
CVE-2019-17358
PUBLISHED: 2019-12-12
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP ...
CVE-2019-17428
PUBLISHED: 2019-12-12
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.