Patch Tuesday defined by the flaws that aren't fixed
- 12 January, 2011 06:34
Microsoft is easing in to 2011 with a light Patch Tuesday for January. There are only two security bulletins this month, and only one of those two is rated as Critical by Microsoft.
MS11-002 is the more urgent of the two security bulletins. According to the Microsoft Security Response Center blog, "This bulletin addresses two vulnerabilities affecting all supported versions of Windows. The first vulnerability is rated Critical for Windows XP, Vista and Windows 7 and the second rated Important for all supported versions of Windows Server."
Joshua Talbot, security intelligence manager for Symantec Security Response provides some additional insight. "The patch for the critical vulnerability corrects a problem in the way MDAC validates memory allocation. The other patch fixes an issue--marked as important-- in the way MDAC validates third-party usage of a Microsoft API. Both vulnerabilities can be exploited by drive-by download, meaning simply viewing a legitimate site that has been compromised by an attacker can lead to a user's machine being exploited."
While IT admins may be thankful that there are so few security bulletins for January, it is worth noting, that there are still known vulnerabilities that remain unpatched following this Patch Tuesday release. The Windows Graphics Rendering Engine and IE zero-day vulnerabilities were not addressed.
"These vulnerabilities can still be exploited," said Dave Marcus, director of security research and communications at McAfee Labs. "It underscores how users and enterprises cannot and should not rely on patching to solve security issues."
In other words, It admins should have a framework of vulnerability and risk assessment tools to intelligently determine the potential impact of a given threat to their own unique environment. In addition, organizations should have layers of defense and the ability to limit exposure and mitigate threats even without a vendor patch.
Andrew Storms, Director of Security Operations for nCircle, e-mailed some insight on the unpatched flaws. "The most interesting thing this month is a new mitigation tactic that Microsoft is calling a 'shim' for the outstanding Internet Explorer bug described in advisory 2488013. The shim uses the application compatibility framework in Windows to rewrite in-memory function calls of MSHTML.DLL. "
Storms continues, "Effectively, this offers an additional check on the known security bug and prevents the vulnerability from occurring. Enterprises are likely to find this tactic enticing because it's easy to deploy and is a relatively low risk. This mitigation tactic is a new offering from Microsoft. They provided a similar kind of shim for Office XP, but this is the first time we have seen this approach to combat an un-patched, active zero-day bug."
Get the patches from Microsoft applied as soon as you can. But--more importantly--be aware of what remains unpatched and make sure you have measures in place to guard against exploits.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Microsoft Security Bulletin Summary for January 2011
- Microsoft Warns of New Windows Vulnerability - PCWorld Business Center
- McAfee Labs
- Can Chrome Continue to Chip Away at Internet Explorer? - PCWorld Business Center
- Microsoft Security Advisory (2488013): Vulnerability in Internet Explorer Could Allow Remote Code Execution
The enlightened CIO’s guide to running projects
The enlightened CIO’s guide to running projects
Why IT projects really fail
Queensland government to provide 200 services online by 2015
Call Centers Suffer From Big Data Overload
Is your data centre growing too complex for your backup?
Backing up data today is growing more complex - and in an era of virtualisation, big data and cloud deployments, it can be difficult to maintain control over your data, resulting in loss and downtime. This hour-long webcast features expert commentary on navigating the complexity of backing up a heavily virtualised infrastructure; simplifying your backup software and hardware ecosystem; reducing the cost of backing up your organisation’s data, and modernising your backup infrastructure with integration. The presentations will conclude with an interactive Q&A session.
IDC: Delivering Customer Value with Enterprise Flash Deployments
When it comes to flash, “one size does not fit all.” IDC examines recent flash trends in enterprise storage deployments. This includes: highlighting how SSDs are filling in gaps of existing storage systems when coupled with intelligent archiving and automated tiering, the pros and cons of different SSD approaches, and tips to overcome concerns of reliability, manageability and scalability.
Pathways Course Curriculum 2014
Developed by the CIO Executive Council, Pathways is a unique, flexible, self-managed, self-paced 12-month professional development program that brings together best practices, thought leadership and business insights for today’s most promising ICT professionals. Pathways is designed and delivered by leading local and global CIOs; enabling participants to capitalise on mentor CIOs personal experiences, expertise and knowledge.