Feeds

Microsoft to slap 9 patches on Windows junkies on Tuesday

Nurse, prep the critical IE update and Windows Defender fix

Beginner's guide to SSL certificates

Microsoft is lining up nine patches - two critical - as part of the April edition of its regular Patch Tuesday update cycle.

The nine bulletins due on 9 April affect all versions of Windows, some Office and Server components as well as Windows Defender on Windows 8 and RT.

The first of the two critical updates covers all versions of Internet Explorer (IE), including the newest IE 10 on Windows 8 and RT. The vulnerabilities covered create a means to run so-called drive-by download attacks that squirt malware at surfers with unpatched systems who happen across hacker-manipulated (often mainstream) websites.

Appearances are that the flaws to be addressed relate to IE bugs uncovered in the recent Pwn2Own competition at CanSecWest, but this remains unconfirmed.

The second critical vulnerability affects most versions of Windows, except for Microsoft's newest software - specifically Windows 8, Server 2012 and Windows RT (the tablet version).

The remaining seven bulletins are all rated “important” and affect Windows, the Sharepoint server, and Windows Defender on Windows 8 and Windows RT. The privilege elevation flaw in Redmond's anti-malware technology clearly stands out from the crowd. "Windows Defender isn’t something that has seen a lot of attention from researchers but would definitely be a juicy target of attackers," said Ziv Mador, director of security research at Trustwave.

Paul Henry, security and forensic analyst at Lumension, added: "Windows Defender is an important security component for the new operating systems, so it’s a little concerning to see it impacted here, even if only at an 'important' rather than critical level. If you’re running either of those systems, I would patch this important bulletin first."

Microsoft's pre-alert advisory can be found here. Additional commentary can be found in a blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, here.

In other patching news, Oracle has scheduled an extra release for Java this month, outside of its normal four-month release cycle release cycle. The additional release is due to appear on 16 April. ®

Beginner's guide to SSL certificates

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.