Agentless Backup is Not a Myth

Hot on the heels of yesterday's batch of updates from Microsoft patching five critical Windows vulnerabilities come reports of new zero-day exploits, some that appear to allow the commandeering of a PC. They underscore a growing pattern in which miscreants release their payloads shortly before or after Patch Tuesday.

According to an entry on the McAfee Avert Labs blog, "several" attacks exploiting weaknesses in Office were released in security forums on Monday. Also making the rounds is proof-of-concept code that attacks Windows.

Microsoft says it is investigating the reports and isn't aware of any customers being targeted by the flaws. It also reiterated an advisory deeming .HLP files as unsafe unless the user is assured they are not malicious.

Among others, yesterday's patch binge fixed flaws in Universal Plug and Play, Windows CSRSS, Microsoft Agent and Microsoft Content Management Server. It also repaired a bug in last week's emergency patch of a critical hole in the way Windows processed animated cursors. Both the cursor vulnerability and CSRSS patch affected Windows Vista, which Microsoft has called its most secure operating system ever.

The simultaneous release of the patches and new zero-days is most likely not by accident. Malicious hackers know Microsoft is reluctant to issue out-of-schedule updates, so timing the release of malware around Patch Tuesday helps ensure a longer shelf life for their precious zero-day exploits. Prior to yesterday's report, Office already suffered from at least two zero-day vulnerabilities, according to eEye Security's zero-day tracker.

According to McAfee, the tally of patches released to date this year well exceeds the number for this time in 2006. Which either means the software behemoth is getting better at identifying and repairing flaws or its security assurances are only so much hot air. ®

Steps to Take Before Choosing a Business Continuity Partner