Feeds

Hellish XML demon exorcised from Windows, IE bug stays

Plus Adobe, Mozilla drive out their own security horrors

Beginner's guide to SSL certificates

Patch Tuesday Microsoft released two "critical" patches and five "important" security updates on Tuesday - but none of the fixes address a zero-day vulnerability in Internet Explorer discovered two weeks ago.

The two critical patches tackle a remote-code execution vulnerability in the Windows Print Spooler (MS13-001) and similarly serious bugs in Microsoft XML Core Services (MS13-002). The latter vulnerability is particularly nasty and affects Windows XP through to Windows 8 and RT, allowing miscreants to take over a compromised system from afar.

The remaining "important" security fixes grapple two further bugs in the Windows operating system: one in System Centre Operations Manager (SCOM), one in .NET and one in OData Services.

None of this plugs the so-called "Mad Woman in the Attic" hole in older but still widely used builds of Redmond's web browser Internet Explorer, namely versions 6, 7 and 8. The software giant rushed out an emergency sticking plaster to thwart attacks that exploit this vulnerability, but researchers and hackers were able to circumvent the temporary defence.

"Although Microsoft has issued a fix-it for the zero-day vulnerability in Internet Explorer a bypass for the fix-it has already been published, which means that people who are still using Internet Explorer 6, 7 or 8 will still be vulnerable until probably next month’s Patch Tuesday," explained Ziv Mador, director of research at security biz Trustwave.

"Of course if you can’t wait until next month’s Patch Tuesday you could also just update your browser to Internet Explorer 9 or 10 or Chrome or Firefox."

The unresolved zero-day vulnerability affects 90 per cent of the Internet Explorer installed base, according to cloud security firm Qualys. Of the patches that have been released in January, the XML Core Services vulnerability ought to take precedence, according to Wolfgang Kandek, CTO at Qualys.

"MS13-002 is the most important patch in the lineup," Kandek explained yesterday.

"It addresses a vulnerability in the MSXML library, which is an integral part of many Microsoft software packages. It affects every Windows version from XP to RT, plus all Office versions and a number of other packages, such as Sharepoint and Groove. The most likely attack vector is a malicious webpage. But an email with an Office document attachment can also be a viable alternative for attackers."

Microsoft's January Patch Tuesday security bulletin is here. A handy cut-out-and-keep colour-coded chart about the updates, made by the SANS Institute's Internet Storm Centre, is here.

Andrew Storms, director of security operations for nCircle, agreed that fixing the XML bug was a top priority. The print-spooler bug is less easily exploited. "Print spooler bugs played a role in the infamous Stuxnet malware, but this bug isn't anything like the vulnerability Stuxnet exploited," Storms added.

It wouldn't be a security patch story without mentioning…

Adobe, in related news, announced a new version of its Reader and Acrobat software complete with security fixes. The cross-platform update needs to be applied to Windows, Mac OS X and Linux machines. A separate advisory details workarounds to defend against three Adobe ColdFusion vulnerabilities, pending the arrival of a more comprehensive patch from the media software biz.

Microsoft also updated Internet Explorer 10 to hoover up a new Adobe Flash build. Updated standalone versions of Adobe Flash can be found by following links in an advisory here.

Last, but not least, Mozilla has upgraded Firefox yet again: the open-source web browser is now up to version 18. Release notes from the non-profit organisation are here, and details of the security fixes bundled can be found here. The update includes 12 critical fixes including a revocation fix for the recently bungled Turktrust web security certificates, patches for a slew of memory-related security holes and a couple of buffer overflow vulnerabilities, although use-after-free bugs predominate.

Mozilla also updates its Thunderbird email client to version 17.0.2 on Tuesday to address the same set of security flaws. ®

Beginner's guide to SSL certificates

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.