Feeds

Happy 10th b-day, Patch Tuesday: TWO critical IE 0-day bugs, did you say?

A decade on, Microsoft pushes out 8 bulletins – half of 'em critical bug squishes

The Power of One eBook: Top reasons to choose HP BladeSystem

Microsoft delivered no fewer than eight bulletins to mark the tenth anniversary of Patch Tuesday, including a fix covering two zero-day vulnerabilities in Internet Explorer.

A critical patch for all supported versions of IE covers a well-anticipated fix for the CVE-2013-3893 vulnerability, which has been associated with cyber espionage-style attacks against targets in Japan, Taiwan and elsewhere in Asia since late August.

Microsoft also released a bonus extra fix for another in-the-wild browser bug. The same MS13-080 bulletin also covers the CVE-2013-3897 vulnerability that has become the target of attacks over the last two weeks or so. FireEye was the first to discover a malware campaign (dubbed Operation DeputyDog) linked to the CVE-2013-3893 security bug, while Trustwave SpiderLabs is claiming the credit for fingering the CVE-2013-3897 flaw.

"MS13-080 also addresses CVE-2013-3897 in an interesting case that illustrates the concurrent discoveries of vulnerabilities," explains Wolfgang Kandek, CTO of cloud security firm Qualys, in a blog post.

"The vulnerability underlying CVE-2013-3897 was found internally at Microsoft and would have been fixed in MS13-080 as part of the normal security engineering and hardening that the product undergoes constantly. However, in the last two weeks, attacks against the same vulnerability became public – again, limited and targeted in scope – but since the fix was in the code already, it enabled Microsoft to address the vulnerability, CVE ID CVE-2013-3897, in record time."

Microsoft explains that the MS13-080 bulletin “fixes multiple security issues, including two critical vulnerabilities that haven't been actively exploited in limited targeted attacks.”

All versions of IE, from 6 to 11, need patching with updates that tackle 10 vulnerabilities in total.

The MS13-080 bulletin is by far the most important of the October batch but Redmond is also releasing three other critical fixes and four "important" security bulletins. The batch, which marks the tenth anniversary of Patch Tuesday, collectively grapples with 26 vulnerabilities.

The critical MS13-081 update addresses seven vulnerabilities in the Windows kernel, including problems in font handling, and can be triggered remotely through malicious web pages and maliciously formatted Office documents. Bugs in Microsoft's .NET Framework and finally a vulnerability in Windows Common Control Library (64 bit only) occupy the remaining two berths on the critical list.

The upshot is that everything from Windows XP up to and including Windows 8 and Windows RT will need patching to defend against security bugs that are more problematic for desktop systems.

Noteworthy "important" vulnerabilities MS13-085 and MS13-086, both cover remote code execution-type vulnerabilities in Microsoft Excel and Microsoft Word, respectively. Security watchers are more worried about the potential for mischief from these bugs than Microsoft itself.

The two other "important" updates cover lesser security bugs in Microsoft Silverlight 5 and Redmond's Sharepoint portal server software.

Microsoft's advisory and an easier to understand graphical overview from the SANS Institute's Internet Storm Centre provide more information.

Adobe – fresh from warning about a compromise on its website that might have exposed the IDs, password hashes, and encrypted credit card information of nearly three million customers – separately delivered a patch for its Acrobat and Reader software. Adobe also patched its RoboHelp software. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.