Patch Tuesday: And EVERY version of IE needs fixing AGAIN
Adobe, VMware join Microsoft in the stocks this month
June's Black Tuesday patch update from Microsoft has rolled into town with five bulletins, including a solitary critical update that tackles flaws in all supported versions of Internet Explorer.
The IE update (MS13-047) grapples with 19 vulnerabilities and covers all versions of IE, from IE6 to IE10, on all supported versions of Windows, from XP to RT. It's just the sort of thing that might be latched onto by hackers as part of drive-by-download attacks, based on malicious scripts on compromised websites, and therefore needs to be patched sooner rather than later.
The other four bulletins this week all cover lesser flaws, rated "important" by Microsoft. The most noteworthy of these is (MS13-051) which covers Microsoft Office 2003 on Windows and 2011 for Mac OS X and tackles a parsing vulnerability for the PNG graphic format that has already cropped up in a limited number of active attacks.
"The attack arrives in an Office document and is triggered when the user opens the document," writes Wolfgang Kandek, CTO at cloud security firm Qualys. "Microsoft rates it only as 'important' because user interaction is required, but attackers have shown over and over that getting a user to open a file is quite straightforward."
The remaining three "important" updates from Microsoft tackle an information disclosure vulnerability within the Windows kernel, a local privilege escalation vulnerability within the print spooler components in Windows, and a DoS problem in the TCP/IP stack of newer Windows systems. Taken altogether it's a fairly quiet month.
June's patch update from Microsoft omits to fix a recent 0-day vulnerability discovered by Google's Tavis Ormandy. The 0-day vulnerability allows an attacker already on a Windows machine to gain admin privileges.
In related patching news, Adobe is pushing out an updated version of Flash (APSB13-16), that will be released to Google Chrome or Microsoft IE10 users via an automatic update. In other cases the cross-platform update - which covers versions of Flash Player on Windows, Macs and Linux as well as Android smartphones - will need to be applied separately.
Meanwhile server and datacentre admins would do well to pay attention to the release of a security bulletin from VMware, covering a vulnerability in handling file uploads by the vCenter Chargeback Manager that poses a remote code execution risk on unlatched systems.
Apple pushed out its own quarterly security fixes last week, with new version of Safari and Mac OS X addressing numerous critical vulnerabilities. These security updates are unrelated to the new versions of Mac OS X and Safari announced at this week's WWDC in San Francisco, which will not be released for some time yet. ®