Microsoft Targets Two IE Zero-Day Flaws in October Patch Tuesday

On the 10th anniversary of Patch Tuesday, Microsoft released eight security bulletins. Four of the October bulletins are rated Critical and four are rated Important. But the Internet Explorer patch is getting the most attention.

EUMicrosoft has addressed 27 CVEs this month. Many people will be happy to see MS13-80, a critical patch for 10 vulnerabilities in Internet Explorer 6 through 11,EU Paul Henry, a security and forensics analyst at Lumension, told us.

EUThere are two known attacks underway so the IE patch should be your priority number one. This patches CVE -2013-3893, a zero day vulnerability Microsoft wrote about in Security Advisory 2887505 September 17.EU

Why WasnEUt It Released Earlier?

Wolfgang Kandek, CTO at Qualys, told us the discussion around a potential earlier release of MS13-080 depended on the number of ongoing attacks Microsoft and the security community detected. Since the volume continued to stay low, even after Metasploit added its implementation, he explained, Microsoft opted for a normal release schedule during Patch Tuesday. This move places the least stress on IT organizations during a month where thereEUs plenty of stress already.

MS13-080 also addresses CVE-2013-3897 in an interesting case that Kandek says illustrates the concurrent discoveries of vulnerabilities. Microsoft found the vulnerability underlying CVE-2013-3897 internally and it would have been fixed in MS13-080 as part of the normal security engineering and hardening that the product undergoes constantly, Kandek explained.

EUHowever, in the last two weeks, attacks against the same vulnerability became public, again limited and targeted in scope, but since the fix was in the code already, it enabled Microsoft to address the vulnerability, CVE ID CVE-2013-3897, in record time,EU he said. EUBy the way the same, but less public reasoning about attack volume as for CVE-2013-3893 has been applied in this case as well: If there had been widespread reports of...

Comments are closed.