August Patch Tuesday is a Big Win for IE
This patch Tuesday handles 2 Critical and 7 important issues. The good news is that 28 CVE related issues for Internet Explorer have been addressed including CVE 2014-2817 (attacks seen in the wild) and CVE 2014-2819 (publicly reported). The balance of the IE issues were privately reported and have not seen active attacks. Lastly for Internet Explorer, Microsoft is also now blocking out of date ActiveX Controls
Summary of Bulletins:
MS14-043 Mitigates a Critical issue in Windows Media Center could allow Remote Code Execution. The vulnerability could be taken advantage of with a specially crafted office document sent via email. The patch addressed 1 related CVE issue.
MS14-044 Mitigates an
July Patch Tuesday Brings 6 Bulletins Addressing 29 CVE's
This Patch Tuesday we have 6 bulletins — 1 Moderate, 3 Important and 2 Critical. While July's patches address 29 CVE issues none are reportedly being used in the wild. Several issues reported during the Pwn2Own hacking contest are corrected this Patch Tuesday.
Looking at the details:
MS14-037 is a Cumulative Security Update for IE. It is rated critical and mitigates 24 CVE issues. Only 1 was reported publicly and it addresses a certificate handling issue.
MS14-038 mitigates a Critical issue that impacts the Windows Journal that could allow a Click2Pwn exploit. This patch mitigates 1 CVE related issue.
MS14-039 is an Important issue that mitigates a vulnerability in the On-Screen Keyboard that could allow an
June Patch Tuesday Brings 7 Bulletins Addressing 66 CVE's
Good News Is - None Are Being Used In Active Attacks
This Patch Tuesday we have 7 bulletins — 5 Important and 2 Critical. While June's patches address 66 CVE issues none are reportedly being used in the wild. In fact only two of the 66 CVE's were publicly disclosed.
Looking at the details
MS14-030 is an Important issue that impacts Remote Desktop that could allow Tampering. This patch mitigates 1 CVE related issue.
MS14-031 is an Important issue that impacts the TCP Protocol that could allow a Denial of Service. This patch mitigates 1 CVE related issue.
MS14-032 is an Important issue that impacts Lync Server that could allow Information Disclosure. This patch mitigates 1 CVE related issue.
Yes It's A Busy Patch Tuesday — But There Is Good News In The Details
Microsoft delivers 8 Patches in total — 2 are Critical and 6 are Important. Microsoft seems to be digging in deeper and is clearly going beyond simply focusing on critical issues in its addressing of a larger numbers important level issues again this Patch Tuesday. This is good as it can actually improve our longer-term security prospects by eliminating these issues from being available in a bad guys playbook.
As expected MS14-029 for IE is at the top of the priority list this atch Tuesday because one of the CVEs it addresses is under active attack in the wild.
The next priority is MS14-024 addressing an issue in MSCommon Control as it also has been used in active attacks to bypass ASLR. The Good News for IT this Patch Tuesday is that while this is only an Important rated issue, fixing this will go a long way in helping to protect customers
The End is Near Here!
We have officially reached the end of support for Windows XP today. If you have not already moved off of XP to Windows 7 or Windows 8 remember that without ongoing patch support from Microsoft for XP you are now exposed too much greater risk. An interim solution that will be able to run your current Windows XP applications may be to move to Windows 2003. This allows you to effectively buy yourself another year of operating on a supported platform that does not require modifications to your applications until you can update your applications and then move to a current generation Windows OS.
This April 2014 Patch Tuesday includes 4 bulletins — 2 Critical and 2 Important
- MS14-017 is a Critical issue that impact Microsoft Word and Office Web Applications that could allow a Remote Code Execution. Reportedly it is under active attack. The patch mitigates 3 CVE issues; CVE-2014-1757, CVE-2014-1761