Following an unusually light Patch Tuesday in September, Microsoft has moved to deal with the spectre of a zero-day exploit being used in the wild to attack Internet Explorer. The company responded with an out-of-band patch reflecting the urgent nature of the threat.
IT admins will be a little busier in October. According to the Microsoft Security Bulletin Advance Notification for October 2012, Microsoft has a total of seven new security bulletins slated for release next week. Six of the seven are rates merely as Important, while the seventh, a patch for a flaw affecting all supported versions of Microsoft Word, is rated as critical for Word 2010.
Andrew Storms, director of security operations for nCircle, stresses the urgency of the patch for Microsoft Word. "The bulletin that looks most serious is a rare Microsoft Word update tagged as critical for the brand new Word 2010, but downgraded to important in Word 2003. I can’t remember the last time we saw a critical bug that affected all versions of Word. It makes me remember the bad old days when Word was a nearly constant source of security problems for businesses."
Marcus Carey, a security researcher with Rapid7, points out that the vulnerability can be triggered by opening, or even previewing, a malicious file. "This vulnerability could result in the complete compromise of a system if exploited. Since this is an Office vulnerability this may affect both Windows and Macintosh users."
Some bulletins, like Bulletin 7, indicate a potentially alarming fact. The bulletin impacts versions of SQL Server going back to 2000, and indicates a flaw in code that has been reused for more than a decade. According to Alex Horan, a senior product manager with CORE Security, "When you look at the number of versions that are affected you quickly come to the determination that these vulnerabilities have existed for quite a long period of time and have potentially been abused without user knowledge throughout several generations of the software.
Storms also noted that Microsoft is issuing one final reminder that changes are imminent for acceptable key lengths for RSA keys. "If you haven’t already fixed this time is running out. If your key lengths are too short your Microsoft applications will stop working, so it might be worth your time to review this one more time."
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers