All aboard the patch wagon! Next stop: Microsoft, Adobe, Mozilla

Come on, those security bugs won't fix themselves


Today, right on schedule, Microsoft's monthly security patch bandwagon rolled into town with updates for Internet Explorer, Office and Windows - with Adobe bringing up the rear.

This latest instalment of Patch Tuesday addresses 33 bugs in a range of Redmond software, as revealed late last week. The flaws have been grouped into 10 updates: two marked critical and eight important.

One of the critical patches (MS13-037) fixes use-after-free vulnerabilities and information leaks in every version of Internet Explorer, from version 6 through 10. The other critical update (MS13-038) tackles a remote-code-execution hole in IE 8, which was first exploited by malicious code injected by hackers into a US Department of Labor website. The bug is also present in IE 9, but there have been no reported attempts to capitalise on the flaw.

"While no known attack vectors exist for Internet Explorer 9 in the default configuration, the vulnerable component still exists and is therefore receiving an update," explained Marc Maiffret, chief technology officer at IT security outfit BeyondTrust.

Microsoft's May patch batch contains eight lesser "important" updates; the most pressing is a denial-of-service vulnerability (MS13-039) in Windows 8, Server 2012, and RT. The other updates close holes in the instant-messaging app Lync, Visio, Publisher and Word. There's also a fix for an authentication bypass in .NET and a security update for Windows Essentials - a bundled package of utilities. Lastly, there's a patch to resolve an important privilege elevation flaw in Windows kernel-mode drivers.

Microsoft's roundup of the security fixes is here, and there's a graphical overview from the Internet Storm Centre here.

And it wouldn't be a security update story without…

Not to be left out, Adobe published updates for three of its products: website development system ColdFusion, Flash, and PDF software Reader and Acrobat. The ColdFusion patch addresses a vulnerability already being exploited in the wild: the security hole was used to swipe sensitive data from the US's Washington State Court System, which led to the exposure of 160,000 social security numbers and one million driver licence numbers.

The Acrobat/Reader update (APSB13-15) contains fixes for 27 security blunders, and targets all versions of Reader on Windows, Mac OS X and Linux. The update is critical for Reader/Acrobat 9 on Windows and "important" for other builds. All need patching sooner rather than later because Reader PDF vulnerabilities are such a hacker's favourite.

The Flash update (APSB13-14) addresses seven vulnerabilities, all unearthed by Google's security team. Commentary on Adobe's patches, as well as the security updates from Microsoft, can be found in a blog post by Wolfgang Kandek, CTO at cloud security firm Qualys, here.

And in yet more patching news, Mozilla pushed out its latest version of its browser and a maintenance release for its Thunderbird email client. Firefox 21.0 fixes eight security issues, including three critical bugs all involving memory-related programming errors. For the completists out there, security commentary specifically focused on the Mozilla updates can be found in a blog post by Paul Ducklin on Sophos's Naked Security blog here. ®


Other stories you might like

  • Did ID.me hoodwink Americans with IRS facial-recognition tech, senators ask
    Biz tells us: Won't someone please think of the ... fraud we've stopped

    Democrat senators want the FTC to investigate "evidence of deceptive statements" made by ID.me regarding the facial-recognition technology it controversially built for Uncle Sam.

    ID.me made headlines this year when the IRS said US taxpayers would have to enroll in the startup's facial-recognition system to access their tax records in the future. After a public backlash, the IRS reconsidered its plans, and said taxpayers could choose non-biometric methods to verify their identity with the agency online.

    Just before the IRS controversy, ID.me said it uses one-to-one face comparisons. "Our one-to-one face match is comparable to taking a selfie to unlock a smartphone. ID.me does not use one-to-many facial recognition, which is more complex and problematic. Further, privacy is core to our mission and we do not sell the personal information of our users," it said in January.

    Continue reading
  • Meet Wizard Spider, the multimillion-dollar gang behind Conti, Ryuk malware
    Russia-linked crime-as-a-service crew is rich, professional – and investing in R&D

    Analysis Wizard Spider, the Russia-linked crew behind high-profile malware Conti, Ryuk and Trickbot, has grown over the past five years into a multimillion-dollar organization that has built a corporate-like operating model, a year-long study has found.

    In a technical report this week, the folks at Prodaft, which has been tracking the cybercrime gang since 2021, outlined its own findings on Wizard Spider, supplemented by info that leaked about the Conti operation in February after the crooks publicly sided with Russia during the illegal invasion of Ukraine.

    What Prodaft found was a gang sitting on assets worth hundreds of millions of dollars funneled from multiple sophisticated malware variants. Wizard Spider, we're told, runs as a business with a complex network of subgroups and teams that target specific types of software, and has associations with other well-known miscreants, including those behind REvil and Qbot (also known as Qakbot or Pinkslipbot).

    Continue reading
  • Supreme Court urged to halt 'unconstitutional' Texas content-no-moderation law
    Everyone's entitled to a viewpoint but what's your viewpoint on what exactly is and isn't a viewpoint?

    A coalition of advocacy groups on Tuesday asked the US Supreme Court to block Texas' social media law HB 20 after the US Fifth Circuit Court of Appeals last week lifted a preliminary injunction that had kept it from taking effect.

    The Lone Star State law, which forbids large social media platforms from moderating content that's "lawful-but-awful," as advocacy group the Center for Democracy and Technology puts it, was approved last September by Governor Greg Abbott (R). It was immediately challenged in court and the judge hearing the case imposed a preliminary injunction, preventing the legislation from being enforced, on the basis that the trade groups opposing it – NetChoice and CCIA – were likely to prevail.

    But that injunction was lifted on appeal. That case continues to be litigated, but thanks to the Fifth Circuit, HB 20 can be enforced even as its constitutionality remains in dispute, hence the coalition's application [PDF] this month to the Supreme Court.

    Continue reading

Biting the hand that feeds IT © 1998–2022