Feeds

How's it going, Microsoft users? Patching your PCs? You SHOULD be

Five remote-code execution holes to plug – and two actively exploited

Build a business case: developing custom apps

Patch Tuesday Brace yourselves, users and administrators, Microsoft and Adobe have released another monthly batch of critical security updates for their products.

The December edition of Patch Tuesday will fix five critical vulnerabilities in Microsoft software, two which are being exploited in the wild by miscreants.

The first of the critical flaws lies within the handling of TIFF image files in Windows Vista, Server 2008, Lync and Office 2010, 2007 and 2003. If exploited, an attacker could use the bug to remotely execute code on the targeted system with full administrative rights.

The second critical fix addresses a flaw in the WinVerifyTrust security component which could be exploited to bypass code-signing protections in the operating system, thereby allowing an attacker to inject malicious code into a trusted executable that's run when the tainted program is unwittingly launched. This affects all supported versions of Windows and Windows Server. Microsoft said the bug has been exploited in the wild in targeted attacks.

Of the remaining updates from Microsoft, three are rated critical but have not yet been exploited in the wild. Those bulletins include fixes for remote-code execution flaws in the Scripting Runtime in all supported Windows, Internet Explorer and Exchange.

An additional six patches will address flaws that have been rated by Microsoft as "important". One of these bugs has been exploited in the wild and is a security bypass hole in Microsoft Office. Other fixes squash an information-disclosure bug in Office, the ability to elevate privileges on Windows using driver-level programming blunders, and a remote-code execution flaw in SharePoint.

You can find a summary of the updates over at Microsoft's security response blog.

Adobe, meanwhile, has issued its own monthly updates to remedy security vulnerabilities in Flash Player and Shockwave. The company said that both updates will close holes that, if exploited, could allow an attacker to remotely execute code on a targeted machine. Adobe recommends that all Windows, OS X and Linux users update their copies of Flash, Air and Shockwave in order to protect against attack.

Adobe made a point to emphasize that neither of the patches concern issues related to its customer database breach in October, which resulted in the leaking of sensitive account information. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?