MSFN Forum: Microsoft Shows Security Improvements with 2011 Patch Tuesdays

Microsoft on Tuesday issued 13 security bulletins. Only three were rated critical. That's a small reprieve since IT admins expected 14 bulletins -- the fix for the so-called Beast attack did not make it into this release.

December's Patch Tuesday brings Microsoft's total to 99 bulletins in 2011.

Joshua Talbot, security intelligence manager for Symantec Security Response, said the most important patch this month is the TrueType Font Parsing issue, which is the zero-day vulnerability exploited as part of the Duqu targeted attacks.

"The Duqu malware didn't actually incorporate an exploit for this issue in its code, but the vulnerability was used by malicious e-mail attachments to load Duqu onto targeted systems," he explained.

Symantec typically puts Internet Explorer cumulative updates pretty high on its priority list, Talbot added, but this month none of the IE vulnerabilities are particularly high-impact issues.

"They're still important, but we suggest prioritizing quite a few of the other bulletins ahead of them. For example, the Windows Media Player DVR-MS memory corruption issue," Talbot said. "This one looks pretty simple to exploit and can result in a complete system takeover. To make matters worse, [data execution prevention] and [address space layout randomization] only offer limited protection here."

No Out-of-Band Patches in 2011

Andrew Storms, director of security operations at nCircle, noted that it's been a long time since Microsoft pulled a bulletin at the last minute. Microsoft pulled the Beast fix because of a bad interaction with a high-profile vendor.

"This last minute change highlights the extensive testing Microsoft does during the patch releases. A bad patch makes for the worst sort of IT heartburn," Storms said. "I'm sure we'll see the 'Beast' bulletin in the January patch, and waiting a little longer for a fix shouldn't be much of an issue because it's fairly difficult to take advantage of this bug."

Although anything could happen in the next two weeks, Storms pointed out that Microsoft appears to have made it through 2011 without having to issue an out-of-band patch. In fact, he added, the year has been marked by lower severity ratings for all vulnerabilities.

"The new, improved risk mitigation technologies in Windows 7 and IE9 just might make out-of-band Microsoft patches a thing of the past," Storms said, "and that would be the best holiday gift Microsoft could give."

View: Microsoft Security Bulletin for December 2011
Source: News Factor