Microsoft issues patch plans, includes Internet Explorer fix

Microsoft on Thursday posted its plans for next week’s Patch Tuesday.

Nine bulletins are expected to be issued to address 21 vulnerabilities, with four labeled “critical” and the rest “important.” The four critical fixes are intended to correct flaws that could allow remote code execution in Windows, Internet Explorer, .NET Framework, and Silverlight, Microsoft’s web development tool.

“Important” patches are expected to be issued to address bugs in the Office suite, as well as server software, that could grant privilege escalation to attackers, which gives them authorization permissions beyond what was intended.

Wolfgang Kandek, CTO at vulnerability management firm Qualys, said the critical update to Internet Explorer should receive the highest priority, as criminals are ramping up their use of  browser-based attacks.

“A couple of years ago, email was the most prevalent method of attack,” Kandek told SCMagazine.com on Thursday. “Today, it is web browsers.”

To illustrate his point, he referenced a vulnerability that was patched Jan. 10 by Microsoft, but was exploited roughly two weeks later. The attack was delivered through the browser and involved a malicious audio file played via the Windows Media Player.

As usual, Microsoft advised users to apply these patches via Microsoft Update, Windows Update and the Microsoft Download Center to keep their software up to date. Mac users can receive uploads automatically with Microsoft AutoUpdate for Mac, available here.

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s