Enterprise Software

Sept. Patch Tuesday One To Remember, With 13 Bulletins

Sept. Patch Tuesday One To Remember, With 13 Bulletins
September 11, 2013 11:12AM

Bookmark and Share
Paul Henry, a security and forensics analyst at Lumension, said this month's Patch Tuesday, with its 13 bulletins and 47 patches, is a September to remember. By way of comparison, September 2012's release only contained two bulletins -- and both were rated as important. Internet Explorer, SharePoint and Outlook are hardest hit with security fixes this month.

You have the experience and skills, let an ISACA® certification demonstrate your value. Our certifications announce that you have the expertise and insight to speak with authority. ISACA certification is more than a credential; it's a platform that can elevate your career. Register for an Exam Today.

Microsoft on Tuesday issued 13 security bulletins. Four are rated critical. The cumulative 47 patches address vulnerabilities in Microsoft Windows, Office, Outlook, Internet Explorer and SharePoint. Microsoft recommends focusing on MS13-067, MS13-068, and MS13-069 first.

"While the Outlook bulletin is certainly one to pay attention to, building a reliable exploit for this issue won't be easy," said Dustin Childs, group manager, Microsoft Trustworthy Computing. "Still, we've listed this update as one of our highest priorities for this month and encourage customers to deploy the bulletins to help ensure protection."

2004 Risks Real Again

Microsoft is putting top priority on MS13-067, which affects SharePoint Server. The most severe vulnerability is CVE-2013-1330, which allows remote code execution by malicious content sent to the server without user interaction, genuine real-time remote exploitation, said Ross Barrett, a senior manager of security engineering at Rapid 7.

"Of the 10 CVEs, one is public, but supposedly that is not CVE-2013-1330," he told us. "There is a workaround for CVE-2013-1330 related to enabling state inspection for message authentication code attributes."

The other two critical advisories require user interaction to trigger the vulnerabilities. However, Barrett noted that MS13-068 affecting Microsoft Outlook is particularly toxic because it can be triggered when users view malicious content in the Outlook preview pane.

"Apparently, we have gone back in time and the risks from 2004 are real again," he said. "This is pretty significant and administrators will have to move fast to patch this before exploits appear."

SharePoint Shops Beware

MS13-070 is concerning to Barrett because it only applies to XP and Server 2003, and those vulnerabilities tend to be less "contained" than more mature versions of Windows.

"If you are running an MS-heavy shop and have significantly invested in the back office technology of SharePoint and all its glorious services, then this month is going to be very busy for you," he said.

"There are lots of vulnerabilities to patch, many of which are high risk. Office vulnerabilities are typically mitigated by the fact that they require a user to interact with something malicious, either through an attachment or a link, in order to be exploited. But with the SharePoint that degree of mitigation may go away and other factors of defense-in-depth will come into play."

The Hardest Hit

We turned to Paul Henry, a security and forensics analyst at Lumension, to get his take on this month's Patch Tuesday. He told us this is definitely a September to remember. By way of comparison, September 2012's release only contained two bulletins -- and both were rated as important.

"We're seeing big numbers this month but there is perhaps some good news: only four patches are considered critical, two were publicly known yet Microsoft has not seen active attacks on any of the September CVEs to-date and none of them impact the current code base," Henry said.

IE, SharePoint and Outlook are hardest hit this month, Henry said, and vulnerabilities in XP and Windows 2003 were also patched -- a practice he hopes to see more of as the XP end-of-life date of April 8, 2014, nears. Windows 2003 has an end-of-life date of July 14, 2015. For anyone using XP, he said, a migration plan should be put in place if you do not already have one.

Tell Us What You Think
Comment:

Name:



 Enterprise Software
1. How Chrome Eats Your Battery Life
2. Cisco Woos More Devs with DevNet
3. Investor Wants EMC To Spin Off VMware
4. Are These Layoffs Best for Microsoft?
5. Esri, SAP Team on Data Mapping




 Most Popular Articles
1. Experts Say Four Threats Put Internet Freedom at Risk
2. Review: Warming Up to Tablets with Keyboard Covers
3. Gartner Rates Security Solutions in Annual Magic Quadrant Report
4. Android SMS Worm Lets Bad Actors Cash In
5. Aerohive Helps Retailers Engage In-Store Customers


Have an informed opinion on this story?
Send a Letter to the Editor.
We want to know what you think.
Send us your Feedback.

 Related Topics  Latest News & Special Reports

  Lenovo Still in Small Windows Tablets
  How Chrome Eats Your Battery Life
  Cisco Woos More Devs with DevNet
  Investor Wants EMC To Spin Off VMware
  Schools Buy Million Chromebooks in Q2

 Technology Marketplace
Big Data
Unlock your enterprise data's potential. Learn how in the research report.
Are you getting everything you can out of your business data?
 
Business Intelligence
Get real-time, cloud-based information services with Neustar.
 
CIO Issues
Secure and retain skilled technology professionals. Learn how.
 
Cloud Computing
Are you getting everything you can out of your business data?
 
Data Storage
Unlock your enterprise data's potential. Learn how in the research report.
 
Enterprise Hardware
Protect your network with APC Smart-UPS battery backup
Cisco UCS Invicta Series flash memory systems
 
Enterprise I.T.
Register for an upcoming ISACA® certification exam today
Secure and retain skilled technology professionals. Learn how.
 
Enterprise Software
Unlock your enterprise data's potential. Learn how in the research report.
 
Hardware
Protect your network with APC Smart-UPS battery backup
Cisco UCS Invicta Series flash memory systems
 
Network Security
Protect your network with APC Smart-UPS battery backup