Data Security

March Patch Tuesday Points to Desirability of IE 11 Upgrade

March Patch Tuesday Points to Desirability of  IE 11 Upgrade
March 12, 2014 10:33AM

Bookmark and Share
"Anymore, it's cause for pause when we don't see an IE update in Microsoft's Patch Tuesday. It's a popular browser and a favorite among attackers," said Russ Ernst of security firm Lumension. "Internet Explorer accounted for 27 percent of all Microsoft vulnerabilities last year, making it the most targeted Microsoft application."

APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.

Microsoft on Tuesday released five security bulletins: two ranked critical and three ranked important. The bulletins fix 23 vulnerabilities in Microsoft Windows, Internet Explorer and Silverlight.

"Obviously the IE update should be your highest priority, but do not ignore the update eliminating a DEP [data execution prevention] and ASLR [address space layout randomization] bypass as it can have a long term impact in improving your systems' security," said Dustin Childs, group manager, Microsoft Trustworthy Computing. MS14-012 addresses 18 issues in IE.

Childs also pointed to MS14-014, which provides an update to address a security feature bypass in Silverlight. This issue wasn't publicly known and it isn't under active attack, he said, however it can affect your security in ways that are not always obvious.

IE Fix, No Surprise There

"Anymore, it's cause for pause when we don't see an IE update in Microsoft's Patch Tuesday. It's a popular browser and a favorite among attackers," said Russ Ernst, director of product management at security firm Lumension. "Internet Explorer accounted for 27 percent of all Microsoft vulnerabilities last year, making it the most targeted Microsoft application. While updating IE, make sure you also include the Flash Player update from Adobe released on Feb. 20."

Ernst also called out MS14-013, the second critical bulletin this month. He reports this vulnerability could allow a remote code execution in DirectShow for all supported versions of Windows. However, the good news is that the attack method requires a user to click on a specially crafted JPEG file in IE -- and there are no known active attacks.

"The final bulletin for this Patch Tuesday is MS14-016," Ernst told us. "It covers one CVE [common vulnerability and exposure] for a vulnerability in Security Account Manager Remote Protocol that could allow a security feature bypass. In this instance, an attacker could lock out a user account if they have an account name using return status codes and brute force to break the password."

Is IE 11 the Way to Go?

Tyler Reguly, manager of security research at security firm Tripwire, confirmed that the IE update is at the top of everyone's list this month. He said that's no surprise, considering it resolves multiple vulnerabilities, including two zero-day issues, one in IE 8 and one in IE 10. As he sees it, this is more proof that IE 11 is the way to go.

"Last week I mentioned that I thought it was time for Microsoft to give up on Silverlight -- it sees a lot of patches given its limited adoption," Reguly said. "It appears that the Microsoft EOL date for Silverlight 5 reaches into 2021. That's a long time for this technology to continue to receive updates."

Since Microsoft is committed to supporting it, Reguly said it would be nice to see Web sites still using it commit to dropping it because consumers could then uninstall Silverlight and effectively increase security of end user. He said running a Web technology to support one or two sites is not an effective way to limit the attack surface of a system.

"Perhaps the most interesting update this month is MS14-016, which fixes an API call in the security account manager that allows you to brute-force Active Directory accounts while avoiding the password attempt lock-out policy," Reguly said. "Password attempt lock-out policies are put in place specifically to prevent brute-force attempts, and allowing a malicious attacker to bypass the policy completely defeats the protection it provides."

Tell Us What You Think
Comment:

Name:



 Data Security
1. Juniper DDoS for High-IQ Networks
2. Google Hacker Team to Hunt Bugs
3. Cloud Firms Offer Azure Starter Kit
4. FBI Cyber-Expert's Humble Start
5. Chinese Hackers Hit U.S. Officials




 Most Popular Articles
1. Experts Say Four Threats Put Internet Freedom at Risk
2. Review: Warming Up to Tablets with Keyboard Covers
3. Gartner Rates Security Solutions in Annual Magic Quadrant Report
4. Android SMS Worm Lets Bad Actors Cash In
5. Aerohive Helps Retailers Engage In-Store Customers

Have an informed opinion on this story?
Send a Letter to the Editor.
We want to know what you think.
Send us your Feedback.

 Related Topics  Latest News & Special Reports

  Lenovo Still in Small Windows Tablets
  How Chrome Eats Your Battery Life
  Cisco Woos More Devs with DevNet
  Investor Wants EMC To Spin Off VMware
  Schools Buy Million Chromebooks in Q2

 Technology Marketplace
Big Data
Unlock your enterprise data's potential. Learn how in the research report.
Are you getting everything you can out of your business data?
 
Business Intelligence
Get real-time, cloud-based information services with Neustar.
 
CIO Issues
Secure and retain skilled technology professionals. Learn how.
 
Cloud Computing
Are you getting everything you can out of your business data?
 
Data Storage
Unlock your enterprise data's potential. Learn how in the research report.
 
Enterprise Hardware
Protect your network with APC Smart-UPS battery backup
Cisco UCS Invicta Series flash memory systems
 
Enterprise I.T.
Register for an upcoming ISACA® certification exam today
Secure and retain skilled technology professionals. Learn how.
 
Enterprise Software
Unlock your enterprise data's potential. Learn how in the research report.
 
Hardware
Protect your network with APC Smart-UPS battery backup
Ferocious productivity. A fearless team of pros. Find Out More
Cisco UCS Invicta Series flash memory systems
 
Network Security
Protect your network with APC Smart-UPS battery backup
 
Small Business
Ferocious productivity. A fearless team of pros. Find Out More