Microsoft will issue 14 security bulletins next week to patch 20 vulnerabilities in Windows, Internet Explorer (IE), Office, and Windows Media Player.
Among the patches will likely be ones to plug the hole used by the Duqu intelligence-gathering Trojan, and to fix the SSL (secure socket layer) 3.0 and TLS (transport layer security) 1.0 bug popularised three months ago by the BEAST, for “Browser Exploit Against SSL/TLS,” hacking tool, security experts said.
“They’re all over the map,” said Andrew Storms, director of security operations at nCircle Security, describing the wide range of Microsoft products slated for patching. “It looks like a big cleanup, where they’re trying to get as much as they can off their plate before the end of the year.”
Three of the 14 updates were tagged with Microsoft’s “critical” label, the highest threat ranking in its four-step system, while the remaining 11 were marked “important,” the second-highest rating.
Bugs in 10 of the updates could be exploited by attackers to remotely plant attack code on unpatched PCs, Microsoft said in its monthly advance notification that precedes each Patch Tuesday. A number of those bulletins were pegged as important, a move Microsoft makes when the bugs cannot easily be exploited because the pertinent components are not switched on by default or because defensive technologies like ASLR and DEP help protect users.
Storms pointed to the IE update as the one that users should apply as soon as possible, advice he – and other researchers outside Microsoft – regularly give when Microsoft patches its browser.
People might not get round to patching
“What’s kind of weird is that because of the every-other-month [IE patch] cycle, most people are online this month buying things, and not a lot of people will get around to patching,” said Storms.
Although Microsoft has gotten into a six-times-a-year patch cadence for IE, Storms questioned whether it was smart to wait until the online spending frenzy to fix browser flaws.
“As we know, once the patches are out, the time necessary to find exploits for the bugs is shorter and shorter now,” Storms said. “Why not bring the IE update back a month to November?”
The critical update labeled only as “Bulletin 1″ should also be patched pronto, said Marcus Carey, a security researcher with Rapid7.
Carey correlated the versions of Windows affected by Bulletin 1 with those called out over a month ago in a Microsoft security advisory, and concluded that the update will patch the vulnerability exploited by Duqu , malware that some antivirus firms called a possible precursor to the next Stuxnet , the ultra-sophisticated worm that last year sabotaged Iran’s nuclear fuel enrichment program .
“The main reason why I think this is the Duqu zero-day patch is that [Bulletin 1] requires a restart, which indicates it’s a kernel-level bug that is being patched, and it affects all the same operating systems as in the [November] advisory,” said Carey in an email.
Storms also expects that Microsoft will patch the TrueType parsing engine vulnerability identified by Microsoft as the bug Duqu leveraged in its attacks, which began months ago and stopped only in October.
Duqu bug patch expected next week
“They’d be silly not to patch Duqu before the end of the year,” said Storms. “They had enough time.”
Last month, Microsoft said it was working on a Duqu bug patch, but acknowledged it wouldn’t be able to deliver a fix in November.
Storms will also look for an update that addresses long-standing issues in SSL 3.0 and TSL 1.0 within Windows. Microsoft released a security advisory in September on the bug after a pair of researchers crafted BEAST, the first-ever practical exploit of the years-old flaw.
The 14 updates slated for next week are three off the record of 17 set in December 2010 and repeated in April 2011.
The total bulletin count for the year – 100, or 5.6 percent fewer – was also down from 2010, and the total number of vulnerabilities patched in those updates was 237, or 10.7 percent less than last year’s record 266.
Mike Reavey, the director of the Microsoft Security Response Center (MSRC), will discuss the year’s bulletins next week during the company’s usual Patch Tuesday video announcement, but Storms expects Reavey won’t focus on the numbers.
“I think they’ll talk about how the severity of vulnerabilities has decreased,” said Storms. “There do seem to have been fewer criticals than in the year prior.”
Storms also pointed out that Microsoft has gone the entire year without issuing an emergency, or “out-of-cycle” update, while it shipped several in 2010.
View full post on National Cyber Security » Computer Hacking