Tenth Anniversary Patch Tuesday brings crucial Microsoft Explorer fix

Microsoft issued four critical security bulletins and four additional important bulletins covering IE, Windows and Microsoft Office

As anticipated, the latest round of Microsoft's Patch Tuesday monthly release of security fixes addresses a widely known Internet Explorer (IE) vulnerability already being exploited by malicious hackers.

Overall, for October's bundle of software patches, Microsoft issued eight bulletins covering 26 vulnerabilities. Microsoft rated four of the bulletins as critical and the other four as important.

The critical IE bulletin covers one publicly disclosed vulnerability and nine vulnerabilities not yet known by the public. The other three critical bulletins address flaws in the Windows OS. Three of the bulletins marked as important address issues with Microsoft Office, and the fourth remedies a problem in Silverlight.

Administrators should apply the patch for the IE vulnerabilities first, advised Wolfgang Kandek, chief technology officer of IT security firm Qualys.

This month's collection also marks the 10th anniversary of Microsoft's Patch Tuesday, which the company started in October 2003 in order to bundle security patches into monthly release cycles, which would allow system administrators to apply them all at the same time, rather than deal with each patch individually.

Although holding on to crucial patches for up to 30 days can be potentially problematic in terms of security -- at least for those patches that address publicly known vulnerabilities -- the monthly release cycle has been beneficial for the industry, in that it brings order to an otherwise unruly process of staying ahead of those who exploit vulnerabilities for nefarious purposes, Kandek said.

"Our perspective has certainly evolved from 10 years ago when Patch Tuesday was started. Back then vulnerabilities were clear cut and straightforward to understand. Today the amount of complexity that goes into the detection and remediation process is truly impressive," Kandek later added in an e-mail statement.

The IE public vulnerability, works by exploiting how IE accesses computer memory, allowing a maliciously designed Web page to gain user privileges on a computer. "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights," a Microsoft advisory warned.

When the vulnerability was made public last month, malicious hackers quickly put it to use. An exploit based on the vulnerability was added to the popular penetration testing framework Metasploit, where it could be used on its own, or as one in a chain of vulnerabilities designed to gain illicit access to computers. Most of the attacks targeted versions 8 and 9 of IE, though all currently supported versions of the browser could be affected.

The IE vulnerability might have been severe enough to warrant Microsoft issuing an out-of-band patch before this month's Patch Tuesday. Instead, the company issued instructions on how to temporarily fix the problem and scheduled the correction for this month's Patch Tuesday. The move was a wise one, Kandek said. "Every time you go out of band, it makes the work of the IT administrators harder, because they have to react to it and push out patches that they were not prepared for," he said.

Although Microsoft deemed the Office patches only as "important," Kandek advised administrators to apply these as soon as possible as well. Computers with either Microsoft Excel or Microsoft Word could be compromised by a maliciously crafted file that harnesses these vulnerabilities to gain control of the user's computer.

"You need to open a file in order to be infected," Kandek said. Qualys sees these vulnerabilities as critical because "opening a Word file or an Excel file is not much of an obstacle," Kandek said

These exploits could also prove to be dangerous in that Office tends not to be patched by administrators or users with the same frequency as IE, Kandek said.

In addition to issuing the patches this Tuesday, Microsoft also awarded a US$100,000 bounty to security researcher James Forshaw for developing a mitigation bypass technique to compromise Microsoft Windows computers by exploiting a series of bugs. Microsoft can use this technique to better understand, and defend against, entire classes of attacks, the company stated.

Adobe also issued critical patches on Tuesday for Adobe Reader and Adobe Acrobat. Kandek recommends patching this software as soon as possible as well.

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com

Join the CSO newsletter!

Error: Please check your email address.

Tags patchesintrusiononline safetyMicrosoftsecuritypatch managementExploits / vulnerabilitiesmalwareDetection / prevention

More about Adobe SystemsExcelIDGMicrosoftQualys

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Joab Jackson

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts