MS13-068 patches one CVE that requires user interaction within a malicious S/MIME email sent via Microsoft Outlook, also rated critical. The exploit code on this one is fairly complex, so it's tough to execute but it is a bad vulnerability.
This is definitely a September to remember – last year at this time Microsoft released only two bulletins and both were only rated Important. Contrast that to today - Microsoft has released 13 patches covering 47 CVEs. One additional important-level bulletin included in the advance notification that addressed a .Net issue was pulled for quality reasons.
According to Paul Henry, security and forensics analyst at Lumension, we’re seeing big numbers this month but there is perhaps some good news: only four patches are considered critical, two were publically known yet Microsoft has not seen active attacks on any of the September CVEs to-date and none of them impact the current code base.
IE, Sharepoint and Outlook are hardest hit this month, and vulnerabilities in XP and Windows 2003 were also patched...something we hopefully will see more of as the XP end-of-life date of April 8, 2014 nears. Win 2003 follows that 15 months later with its own EOL date of July 14, 2015. For anyone using XP, a migration plan must be put in place if you don't already have one.
An eWEEK Property
Copyright 2019 Quinstreet Inc. All Rights Reserved.
Advertiser Disclosure: Some of the products that appear on this site are from companies from which QuinStreet receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. QuinStreet does not include all companies or all types of products available in the marketplace.