Recent Forum Topics
- XP 64-bit installaton onto an US...
- Microsoft Windows\Office Qu...
- win 7 Unattended question
- I found a "Locked to Win8...
- Is deep-integration for other ar...
- The upcoming new tool for Win 7/...
- Good working Windows XP on Haswe...
- Cannot enter BIOS setup using De...
- OldNewExplorer - make your 8.1 e...
- Intel HD 4000 Graphics Drivers -...
Microsoft Shows Security Improvements with 2011 Patch Tuesdays
Posted on Dec 14 2011 01:41 PM by xper in Security
December's Patch Tuesday brings Microsoft's total to 99 bulletins in 2011.
Joshua Talbot, security intelligence manager for Symantec Security Response, said the most important patch this month is the TrueType Font Parsing issue, which is the zero-day vulnerability exploited as part of the Duqu targeted attacks.
"The Duqu malware didn't actually incorporate an exploit for this issue in its code, but the vulnerability was used by malicious e-mail attachments to load Duqu onto targeted systems," he explained.
Symantec typically puts Internet Explorer cumulative updates pretty high on its priority list, Talbot added, but this month none of the IE vulnerabilities are particularly high-impact issues.
"They're still important, but we suggest prioritizing quite a few of the other bulletins ahead of them. For example, the Windows Media Player DVR-MS memory corruption issue," Talbot said. "This one looks pretty simple to exploit and can result in a complete system takeover. To make matters worse, [data execution prevention] and [address space layout randomization] only offer limited protection here."
No Out-of-Band Patches in 2011
Andrew Storms, director of security operations at nCircle, noted that it's been a long time since Microsoft pulled a bulletin at the last minute. Microsoft pulled the Beast fix because of a bad interaction with a high-profile vendor.
"This last minute change highlights the extensive testing Microsoft does during the patch releases. A bad patch makes for the worst sort of IT heartburn," Storms said. "I'm sure we'll see the 'Beast' bulletin in the January patch, and waiting a little longer for a fix shouldn't be much of an issue because it's fairly difficult to take advantage of this bug."
Although anything could happen in the next two weeks, Storms pointed out that Microsoft appears to have made it through 2011 without having to issue an out-of-band patch. In fact, he added, the year has been marked by lower severity ratings for all vulnerabilities.
"The new, improved risk mitigation technologies in Windows 7 and IE9 just might make out-of-band Microsoft patches a thing of the past," Storms said, "and that would be the best holiday gift Microsoft could give."
View: Microsoft Security Bulletin for December 2011
Source: News Factor