ID: IRCNE2015022422
Date: 2015-02-14
According to “TechWorld”, Microsoft issued patches to cover 56 different vulnerabilities, which are bundled into nine separate security bulletins.
Three of the bulletins are marked as critical, meaning they fix vulnerabilities that could be exploited by malicious attackers without user intervention. System administrators should tend to critical vulnerabilities as quickly as possible. These bulletins cover Internet Explorer and both the server and desktop editions of Windows.
All three collections of critical patches will require a reboot of the machine to take effect.
The patches in the Internet Explorer critical bulletin, which affects all versions of the browser, address the way the browser handles objects in memory. Microsoft has addressed the issue of memory vulnerabilities in its ASLR (address space layout randomization) technology. The patches add permissions validations to ensure Internet Explorer uses ASLR correctly.
Of the 41 Internet Explorer vulnerabilities, only one has been publicly disclosed, but it can only be used in conjunction with other vulnerabilities.
The remaining six bulletins are marked as important, which means they address vulnerabilities that could be exploited by attackers usually by requiring the unwitting participation of the user, such as by tricking him or her into clicking on a specially crafted Web page.
Organizations using Microsoft Office should inspect the bulletins issued this month that touch upon that software, Kandek said. One vulnerability, covered in MS15-012, allows an attacker to gain control of a system merely by tricking the user into opening a document, such as an email, with malicious code embedded inside.
One of the more unusual patches, MS15-011, covers a vulnerability in Windows group policy, which is configuration management technology that Kandek has never seen Microsoft patch before. It only affects larger enterprises that use domain controllers to manage fleets of Windows machines.
In the wrong hands, this vulnerability could be used to take control of large numbers of Windows machines within an organization, Kandek said. MS15-011 shows that Microsoft is digging deeper into its own code base to look for potential security weaknesses.
The group policy patch is not available for Windows 2003, which Microsoft will stop supporting in July.
Microsoft found that the fix would be "too disruptive" to apply to Windows 2003, Kandek said, especially given that the company will stop supporting this operating system shortly. It is a good reminder for those shops still running the nearly outdated OS to update soon.
In addition to releasing the patches, Microsoft did other security housecleaning Tuesday. It has re-released a patch for Microsoft Excel.
- 2