In The Shadow Of Shell Shock - Microsoft October Patch Tuesday Brings 9 Bulletins
Most of us in IT / Flaw Remediation are still struggling with the varied responses from vendors regarding the Shell Shock issue. This Patch Tuesday from Microsoft we have 9 bulletins — 1 Moderate, 5 Important and 3 Critical. While Octobers patches address 24 CVE issues none are reportedly being used in the wild for IE and only limited attacks have been seen in the wild with MS14-058.
Looking at the details:
- MS14-056 is a Cumulative Security Update for IE, it is rated critical and mitigates 14 CVE related issues.
- MS14-057 mitigates a Critical issue that impacts the .NET Framework and could Allow Remote Code Execution. This patch mitigates 3 CVE related issues.
- MS14-058 mitigates a Critical issue in Kernel-Mode Driver that could Allow Remote Code Execution. This patch mitigates 2 CVE
In the wake of the iCloud celebrity photo hack, expert Keith Palmgren offers advice on how to build more effective passwords and avoid easy data breaches.
For more than 40 years, the IT industry has been fighting the password battle and losing. The recent celebrity iCloud hack is just one of many high-profile examples of our failure. So how can something so seemingly simple, like a password, be so difficult?
The problem with password security is that it is so simple, that it is actually paradoxically hard. In security, the most dangerous thing in the world is what you think you know, because then you don't question your knowledge. If you ask a typical IT security professional if they understand passwords, the vast majority will respond with a confident and emphatic "Yes." But if that were really true, why are
The SANS 'Securing Windows with the Critical Security Controls' course (SEC505) will be offered at the December conference in Washington DC.
It's Back To School - With An Exceptionally Light Patch Tuesday
This Patch Tuesday is a welcome light one with only a single critical issue in the Cumulative update for Internet Explorer and only three important issues. Back in September 2013 we saw a much larger IT work load with 13 bulletins — 4 critical and 9 important.
Looking at the details this Patch Tuesday, we have MS14-052 that is the cumulative update for Internet Explorer, which is rated as Critical and that handles mitigations for 37 CVE, related issues. Microsoft has recently updated their Exploitability Index and indicates that for this Internet Explorer patch, Microsoft has seen exploits; hence this patch is for most environments a very high priority.
August Patch Tuesday is a Big Win for IE
This patch Tuesday handles 2 Critical and 7 important issues. The good news is that 28 CVE related issues for Internet Explorer have been addressed including CVE 2014-2817 (attacks seen in the wild) and CVE 2014-2819 (publicly reported). The balance of the IE issues were privately reported and have not seen active attacks. Lastly for Internet Explorer, Microsoft is also now blocking out of date ActiveX Controls
Summary of Bulletins:
MS14-043 Mitigates a Critical issue in Windows Media Center could allow Remote Code Execution. The vulnerability could be taken advantage of with a specially crafted office document sent via email. The patch addressed 1 related CVE issue.
MS14-044 Mitigates an