Feeds

Microsoft to slap 9 patches on Windows junkies on Tuesday

Nurse, prep the critical IE update and Windows Defender fix

Mobile application security vulnerability report

Microsoft is lining up nine patches - two critical - as part of the April edition of its regular Patch Tuesday update cycle.

The nine bulletins due on 9 April affect all versions of Windows, some Office and Server components as well as Windows Defender on Windows 8 and RT.

The first of the two critical updates covers all versions of Internet Explorer (IE), including the newest IE 10 on Windows 8 and RT. The vulnerabilities covered create a means to run so-called drive-by download attacks that squirt malware at surfers with unpatched systems who happen across hacker-manipulated (often mainstream) websites.

Appearances are that the flaws to be addressed relate to IE bugs uncovered in the recent Pwn2Own competition at CanSecWest, but this remains unconfirmed.

The second critical vulnerability affects most versions of Windows, except for Microsoft's newest software - specifically Windows 8, Server 2012 and Windows RT (the tablet version).

The remaining seven bulletins are all rated “important” and affect Windows, the Sharepoint server, and Windows Defender on Windows 8 and Windows RT. The privilege elevation flaw in Redmond's anti-malware technology clearly stands out from the crowd. "Windows Defender isn’t something that has seen a lot of attention from researchers but would definitely be a juicy target of attackers," said Ziv Mador, director of security research at Trustwave.

Paul Henry, security and forensic analyst at Lumension, added: "Windows Defender is an important security component for the new operating systems, so it’s a little concerning to see it impacted here, even if only at an 'important' rather than critical level. If you’re running either of those systems, I would patch this important bulletin first."

Microsoft's pre-alert advisory can be found here. Additional commentary can be found in a blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, here.

In other patching news, Oracle has scheduled an extra release for Java this month, outside of its normal four-month release cycle release cycle. The additional release is due to appear on 16 April. ®

The Essential Guide to IT Transformation

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.