Nothing Pretty About Fireworks This Patch Tuesday

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
Next Nothing Pretty About Fireworks This Patch Tuesday-8 Next

Microsoft has also issued a security advisory this month with a Flash update and they’ve announced a new policy regarding the Windows app store. In order to help protect customers, when vulnerabilities in applications are reported, developers now have 180 days to submit updates to the applications. Updates will come through the Windows app store, which helps ensure that the updates applied are not malicious either. You may recall a proof of concept app from Duo Security that came out a few years ago. Google has since fixed the vulnerability that allowed malicious updates to be installed, but Henry is glad to see Microsoft is not venturing down that same road and is instead going with a secure model for updating applications.

IT admins may have taken the Fourth off to enjoy some fireworks, but they’ll be very busy this week patching their systems. It’s not a pretty Patch Tuesday this month with seven bulletins, six of which are critical. That brings our total of critical bulletins for the year to 22, which is fairly high, considering Microsoft released only 34 critical bulletins for the entire calendar year of 2012. July is one of the uglier releases we’ve seen from Microsoft this year. To say that all Microsoft products are affected and everything is affected critically is not an overstatement. It’s difficult to prioritize one or two because all the bulletins likely need your attention this Patch Tuesday.

While there may be speculation the extensive release is due to Microsoft’s bug bounty program, Paul Henry, security and forensic analyst at Lumension, believes that’s unlikely. Since the announcement of the program took most security researchers by surprise, it will likely be a few months before we really see the effects of the program. That said, he does expect to see the number of bulletins Microsoft issues increase over the second half of this year.

Microsoft has long resisted implementing a bug bounty program, which other vendors have found success with. The start of the program will likely increase the number of bulletins we see over time, but in the long run, will ensure that Microsoft products are more secure. It will also help motivate researchers to improve their disclosure with Microsoft over other sources that purchase vulnerabilities, which includes bad guys. This ensures Microsoft will be aware of vulnerabilities more quickly and we won’t see as many bugs being exploited in the wild before Microsoft is ready to release a patch.

All six of the critical bulletins this month are remote code execution vulnerabilities, which Henry finds concerning. Since these types of vulnerabilities give attackers access to your machine without needing physical access or sometimes even a password, it’s definitely a cause for concern.

 

Related Topics : Unisys, Stimulus Package, Security Breaches, Symantec, Electronic Surveillance

 
More Slideshows

blockchain The World According to Blockchain

Blockchain comes with many costs and is surrounded by confusion. Here, we examine realistic use cases, drawbacks and the potential of blockchain. ...  More >>

biometrics Biometrics: Moving Far Beyond Fingerprints

Biometrics are changing the way we think about security. Here are some of the more innovative ways biometrics are being used and what we can expect in the future. ...  More >>

Privacy rollback Security Pros Give Their Opinions on ISP Data Privacy Rollback

IT staff, organization leaders, and the average citizen have all expressed levels of concern over the FCC about-face in regard to ISP privacy. Here’s what the security experts say. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.