Microsoft Ships Fix for IE Zero-Day Flaw

On Tuesday, Microsoft issued eight security bulletins for its monthly update. The bulletins address 19 vulnerabilities across Microsoft Windows, Internet Explorer and Office. Three of them are critical.

But Redmond didnEUt stop there. The software giant also issued three new advisories: Security Advisory 2862152, Security Advisory 2868725 and Security Advisory 2880823. WhatEUs more, two additional advisories were revised: Security Advisory 2755801 and Security Advisory 2854544 to provide updates for Adobe Flash on IE 10 and improve digital certificate handling in Windows.

We caught up with Tyler Reguly, technical manager of security research and development at Tripwire, to get his take on NovemberEUs Patch Tuesday. He told us IT pros everywhere will have a little less weight on their shoulders because Microsoft shipped a fix for the current IE zero-day.

EUIt's important to note, however, that the fix is not in the traditional IE Cumulative Update -- MS13-088 -- but rather in a separate ActiveX fix -- MS13-090,EU Reguly said. EUAlso patched this month is GDI, and while the bulletin wouldn't normally merit a critical rating, the vulnerability exists in a common API call that may be implemented by numerous third-party products. In addition to applying today's patches, keep an eye out for security updates from other vendors that make use of the built-in Windows' graphics libraries.EU

Unique Outlook Vulnerability

As Reguly sees it, the more interesting patches this month are for a unique Outlook vulnerability that could allow port-scanning, a Hyper-V vulnerability that could allow Guest OS to Guest OS code execution, and an X.509 issue in schannel.dll that could allow denial of service. While these are unique and interesting vulnerabilities, he said, they pose a lot less risk than typical code execution vulnerabilities.

EUItEUs interesting that Microsoft released an update for Direct Access that is not considered a EUsecurity update.' The update...

Comments are closed.