Feeds

How's it going, Microsoft users? Patching your PCs? You SHOULD be

Five remote-code execution holes to plug – and two actively exploited

Build a business case: developing custom apps

Patch Tuesday Brace yourselves, users and administrators, Microsoft and Adobe have released another monthly batch of critical security updates for their products.

The December edition of Patch Tuesday will fix five critical vulnerabilities in Microsoft software, two which are being exploited in the wild by miscreants.

The first of the critical flaws lies within the handling of TIFF image files in Windows Vista, Server 2008, Lync and Office 2010, 2007 and 2003. If exploited, an attacker could use the bug to remotely execute code on the targeted system with full administrative rights.

The second critical fix addresses a flaw in the WinVerifyTrust security component which could be exploited to bypass code-signing protections in the operating system, thereby allowing an attacker to inject malicious code into a trusted executable that's run when the tainted program is unwittingly launched. This affects all supported versions of Windows and Windows Server. Microsoft said the bug has been exploited in the wild in targeted attacks.

Of the remaining updates from Microsoft, three are rated critical but have not yet been exploited in the wild. Those bulletins include fixes for remote-code execution flaws in the Scripting Runtime in all supported Windows, Internet Explorer and Exchange.

An additional six patches will address flaws that have been rated by Microsoft as "important". One of these bugs has been exploited in the wild and is a security bypass hole in Microsoft Office. Other fixes squash an information-disclosure bug in Office, the ability to elevate privileges on Windows using driver-level programming blunders, and a remote-code execution flaw in SharePoint.

You can find a summary of the updates over at Microsoft's security response blog.

Adobe, meanwhile, has issued its own monthly updates to remedy security vulnerabilities in Flash Player and Shockwave. The company said that both updates will close holes that, if exploited, could allow an attacker to remotely execute code on a targeted machine. Adobe recommends that all Windows, OS X and Linux users update their copies of Flash, Air and Shockwave in order to protect against attack.

Adobe made a point to emphasize that neither of the patches concern issues related to its customer database breach in October, which resulted in the leaking of sensitive account information. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?