All aboard the patch wagon! Next stop: Microsoft, Adobe, Mozilla
Come on, those security bugs won't fix themselves
Today, right on schedule, Microsoft's monthly security patch bandwagon rolled into town with updates for Internet Explorer, Office and Windows - with Adobe bringing up the rear.
This latest instalment of Patch Tuesday addresses 33 bugs in a range of Redmond software, as revealed late last week. The flaws have been grouped into 10 updates: two marked critical and eight important.
One of the critical patches (MS13-037) fixes use-after-free vulnerabilities and information leaks in every version of Internet Explorer, from version 6 through 10. The other critical update (MS13-038) tackles a remote-code-execution hole in IE 8, which was first exploited by malicious code injected by hackers into a US Department of Labor website. The bug is also present in IE 9, but there have been no reported attempts to capitalise on the flaw.
"While no known attack vectors exist for Internet Explorer 9 in the default configuration, the vulnerable component still exists and is therefore receiving an update," explained Marc Maiffret, chief technology officer at IT security outfit BeyondTrust.
Microsoft's May patch batch contains eight lesser "important" updates; the most pressing is a denial-of-service vulnerability (MS13-039) in Windows 8, Server 2012, and RT. The other updates close holes in the instant-messaging app Lync, Visio, Publisher and Word. There's also a fix for an authentication bypass in .NET and a security update for Windows Essentials - a bundled package of utilities. Lastly, there's a patch to resolve an important privilege elevation flaw in Windows kernel-mode drivers.
And it wouldn't be a security update story without…
Not to be left out, Adobe published updates for three of its products: website development system ColdFusion, Flash, and PDF software Reader and Acrobat. The ColdFusion patch addresses a vulnerability already being exploited in the wild: the security hole was used to swipe sensitive data from the US's Washington State Court System, which led to the exposure of 160,000 social security numbers and one million driver licence numbers.
The Acrobat/Reader update (APSB13-15) contains fixes for 27 security blunders, and targets all versions of Reader on Windows, Mac OS X and Linux. The update is critical for Reader/Acrobat 9 on Windows and "important" for other builds. All need patching sooner rather than later because Reader PDF vulnerabilities are such a hacker's favourite.
The Flash update (APSB13-14) addresses seven vulnerabilities, all unearthed by Google's security team. Commentary on Adobe's patches, as well as the security updates from Microsoft, can be found in a blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, here.
And in yet more patching news, Mozilla pushed out its latest version of its browser and a maintenance release for its Thunderbird email client. Firefox 21.0 fixes eight security issues, including three critical bugs all involving memory-related programming errors. For the completists out there, security commentary specifically focused on the Mozilla updates can be found in a blog post by Paul Ducklin on Sophos's Naked Security blog here. ®