Feeds

All aboard the patch wagon! Next stop: Microsoft, Adobe, Mozilla

Come on, those security bugs won't fix themselves

The Essential Guide to IT Transformation

Today, right on schedule, Microsoft's monthly security patch bandwagon rolled into town with updates for Internet Explorer, Office and Windows - with Adobe bringing up the rear.

This latest instalment of Patch Tuesday addresses 33 bugs in a range of Redmond software, as revealed late last week. The flaws have been grouped into 10 updates: two marked critical and eight important.

One of the critical patches (MS13-037) fixes use-after-free vulnerabilities and information leaks in every version of Internet Explorer, from version 6 through 10. The other critical update (MS13-038) tackles a remote-code-execution hole in IE 8, which was first exploited by malicious code injected by hackers into a US Department of Labor website. The bug is also present in IE 9, but there have been no reported attempts to capitalise on the flaw.

"While no known attack vectors exist for Internet Explorer 9 in the default configuration, the vulnerable component still exists and is therefore receiving an update," explained Marc Maiffret, chief technology officer at IT security outfit BeyondTrust.

Microsoft's May patch batch contains eight lesser "important" updates; the most pressing is a denial-of-service vulnerability (MS13-039) in Windows 8, Server 2012, and RT. The other updates close holes in the instant-messaging app Lync, Visio, Publisher and Word. There's also a fix for an authentication bypass in .NET and a security update for Windows Essentials - a bundled package of utilities. Lastly, there's a patch to resolve an important privilege elevation flaw in Windows kernel-mode drivers.

Microsoft's roundup of the security fixes is here, and there's a graphical overview from the Internet Storm Centre here.

And it wouldn't be a security update story without…

Not to be left out, Adobe published updates for three of its products: website development system ColdFusion, Flash, and PDF software Reader and Acrobat. The ColdFusion patch addresses a vulnerability already being exploited in the wild: the security hole was used to swipe sensitive data from the US's Washington State Court System, which led to the exposure of 160,000 social security numbers and one million driver licence numbers.

The Acrobat/Reader update (APSB13-15) contains fixes for 27 security blunders, and targets all versions of Reader on Windows, Mac OS X and Linux. The update is critical for Reader/Acrobat 9 on Windows and "important" for other builds. All need patching sooner rather than later because Reader PDF vulnerabilities are such a hacker's favourite.

The Flash update (APSB13-14) addresses seven vulnerabilities, all unearthed by Google's security team. Commentary on Adobe's patches, as well as the security updates from Microsoft, can be found in a blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, here.

And in yet more patching news, Mozilla pushed out its latest version of its browser and a maintenance release for its Thunderbird email client. Firefox 21.0 fixes eight security issues, including three critical bugs all involving memory-related programming errors. For the completists out there, security commentary specifically focused on the Mozilla updates can be found in a blog post by Paul Ducklin on Sophos's Naked Security blog here. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.