Feeds

Patch Tuesday: And EVERY version of IE needs fixing AGAIN

Adobe, VMware join Microsoft in the stocks this month

Website security in corporate America

June's Black Tuesday patch update from Microsoft has rolled into town with five bulletins, including a solitary critical update that tackles flaws in all supported versions of Internet Explorer.

The IE update (MS13-047) grapples with 19 vulnerabilities and covers all versions of IE, from IE6 to IE10, on all supported versions of Windows, from XP to RT. It's just the sort of thing that might be latched onto by hackers as part of drive-by-download attacks, based on malicious scripts on compromised websites, and therefore needs to be patched sooner rather than later.

The other four bulletins this week all cover lesser flaws, rated "important" by Microsoft. The most noteworthy of these is (MS13-051) which covers Microsoft Office 2003 on Windows and 2011 for Mac OS X and tackles a parsing vulnerability for the PNG graphic format that has already cropped up in a limited number of active attacks.

"The attack arrives in an Office document and is triggered when the user opens the document," writes Wolfgang Kandek, CTO at cloud security firm Qualys. "Microsoft rates it only as 'important' because user interaction is required, but attackers have shown over and over that getting a user to open a file is quite straightforward."

The remaining three "important" updates from Microsoft tackle an information disclosure vulnerability within the Windows kernel, a local privilege escalation vulnerability within the print spooler components in Windows, and a DoS problem in the TCP/IP stack of newer Windows systems. Taken altogether it's a fairly quiet month.

Microsoft's Patch Tuesday bulletin for June can be found here. A graphical overview from the SANS Institute's Internet Storm Centre team can be found here.

June's patch update from Microsoft omits to fix a recent 0-day vulnerability discovered by Google's Tavis Ormandy. The 0-day vulnerability allows an attacker already on a Windows machine to gain admin privileges.

In related patching news, Adobe is pushing out an updated version of Flash (APSB13-16), that will be released to Google Chrome or Microsoft IE10 users via an automatic update. In other cases the cross-platform update - which covers versions of Flash Player on Windows, Macs and Linux as well as Android smartphones - will need to be applied separately.

Meanwhile server and datacentre admins would do well to pay attention to the release of a security bulletin from VMware, covering a vulnerability in handling file uploads by the vCenter Chargeback Manager that poses a remote code execution risk on unlatched systems.

Apple pushed out its own quarterly security fixes last week, with new version of Safari and Mac OS X addressing numerous critical vulnerabilities. These security updates are unrelated to the new versions of Mac OS X and Safari announced at this week's WWDC in San Francisco, which will not be released for some time yet. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.