Feeds

Microsoft to send users 4 critical patches on Valentine's Day

Sealed with an XSS

SANS - Survey on application security programs

Microsoft plans to publish nine updates next Tuesday – four of which are critical – as part of a Valentine's Day edition of its Patch Tuesday update cycle.

Highlights of the batch, which collectively address 21 vulnerabilities, include a critical update for Internet Explorer.

There are also two critical fixes for Windows itself, plus one for Microsoft's .NET framework. Three the five remaining "important" fixes grapple with remote code execution-type vulnerabilities, one of which involves Office. Flaws of this type are best addressed sooner rather than later because they might easily be exploited by malware slingers.

Patching IE ought to be be the highest priority, according to vulnerability scanning and web services firm Qualys.

"[W]e saw last month how quickly attackers are incorporating browser-based attacks into their toolkits; an exploit for MS12-004 was detected a mere 15 days after Patch Tuesday," notes Wolfgang Kandek, CTO of Qualys, in a blog post on the upcoming patch batch.

Andrew Storms, director of security operations at net security firm nCircle, said all supported versions of Windows will need patching. Oddly the most recent versions of Windows – which normally need the least patching – are the most affected by the February 2012 patch batch, he added.

"Microsoft is planning to deliver a big 'Valentine' next Tuesday. Their advance notification indicated they plan to release nine bulletins, and 21 CVEs next Tuesday. This is very consistent with last year's 'Valentine delivery' that included 12 bulletins and 22 CVEs."

"It's surprising that this month's patch affects almost every Windows operating system – each OS is affected by five of the eight applicable bulletins. That's kind of weird because newer OS versions are generally more secure."

"It's even more surprising that Windows Server 2008 R2 is affected by the greatest number of bulletins. Generally, we see fewer bugs on server side operating systems, and this is doubly true for Server 2008 since so many of its newer mitigations and default settings protect the OS even when bugs are found," he added.

Microsoft's own pre-alert notice can be found here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.