Feeds

Critical IE update dominates Valentine’s Patch Tuesday

Explorer patch the only one giving sysadmins the fear

Security for virtualized datacentres

The Valentine’s Day edition of Patch Tuesday brought nine security bulletins that collectively address 21 software vulnerabilities.

The batch includes four critical updates but the consensus among security experts is that a security patch for IE is the only one that sysadmins need to worry about. That's because MS12-010 addresses four flaws in all supported versions of Internet Explorer that might easily lend themselves towards crafting drive-by-download exploits and other unpleasantness.

"This month’s Patch Tuesday is relatively light," said Jim Walter, manager of the McAfee Threat Intelligence Service at McAfee Labs. "The Internet Explorer bulletin should be considered a top priority, as there’s a risk of code execution attacks. If not attended to, browser exploits can be particularly harmful."

Wolfgang Kandek, CTO at Qualys, adds that another patch (MS12-013) addresses "equally dangerous" flaw in Windows.

"Attackers can exploit a flaw in a Windows DLL (msvcrt.dll) through a maliciously crafted media file run through Windows Media Player," he explains. "Include this bulletin in your list of high priorities."

The other two critical and five important updates (affecting Microsoft Windows, Microsoft Office and .NET/Silverlight) are less of a practical problem than they might have appeared to be last week, before we knew more about the flaws the updates attempt to resolve, he adds.

Tuesday also brought a series of critical patches for Shockwave Player (Windows and Mac) and one important update in RoboHelp for Word from Adobe.

Multiple third-party vendors have released security updates since January's Patch Tuesday. These include Opera, Google Chrome (twice), Yahoo Messenger, Mozilla Firefox (twice), Mozilla Thunderbird (twice), Mozilla SeaMonkey (twice), Real Player and Skype.

Jason Miller, manager of research and development at VMware – the security researcher keeping count of third-party security updates – warns the sheer volume of updates means a heavy patching workload for some sysadmins.

"For those administrators who wait for a monthly maintenance window for their patching needs, this month is going to be quite a large month combining all of the Microsoft and non-Microsoft security bulletins released since the last Patch Tuesday," he said.

Details of the patches from Microsoft and Adobe can be found here and here, respectively. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.