Menu
Patch Tuesday defined by the flaws that aren't fixed

Patch Tuesday defined by the flaws that aren't fixed

There are only two security bulletins from Microsoft for Patch Tuesday, but a number of vulnerabilities remain unpatched

Microsoft is easing in to 2011 with a light Patch Tuesday for January. There are only two security bulletins this month, and only one of those two is rated as Critical by Microsoft.

MS11-002 is the more urgent of the two security bulletins. According to the Microsoft Security Response Center blog, "This bulletin addresses two vulnerabilities affecting all supported versions of Windows. The first vulnerability is rated Critical for Windows XP, Vista and Windows 7 and the second rated Important for all supported versions of Windows Server."

Joshua Talbot, security intelligence manager for Symantec Security Response provides some additional insight. "The patch for the critical vulnerability corrects a problem in the way MDAC validates memory allocation. The other patch fixes an issue--marked as important-- in the way MDAC validates third-party usage of a Microsoft API. Both vulnerabilities can be exploited by drive-by download, meaning simply viewing a legitimate site that has been compromised by an attacker can lead to a user's machine being exploited."

While IT admins may be thankful that there are so few security bulletins for January, it is worth noting, that there are still known vulnerabilities that remain unpatched following this Patch Tuesday release. The Windows Graphics Rendering Engine and IE zero-day vulnerabilities were not addressed.

"These vulnerabilities can still be exploited," said Dave Marcus, director of security research and communications at McAfee Labs. "It underscores how users and enterprises cannot and should not rely on patching to solve security issues."

In other words, It admins should have a framework of vulnerability and risk assessment tools to intelligently determine the potential impact of a given threat to their own unique environment. In addition, organizations should have layers of defense and the ability to limit exposure and mitigate threats even without a vendor patch.

Andrew Storms, Director of Security Operations for nCircle, e-mailed some insight on the unpatched flaws. "The most interesting thing this month is a new mitigation tactic that Microsoft is calling a 'shim' for the outstanding Internet Explorer bug described in advisory 2488013. The shim uses the application compatibility framework in Windows to rewrite in-memory function calls of MSHTML.DLL. "

Storms continues, "Effectively, this offers an additional check on the known security bug and prevents the vulnerability from occurring. Enterprises are likely to find this tactic enticing because it's easy to deploy and is a relatively low risk. This mitigation tactic is a new offering from Microsoft. They provided a similar kind of shim for Office XP, but this is the first time we have seen this approach to combat an un-patched, active zero-day bug."

Get the patches from Microsoft applied as soon as you can. But--more importantly--be aware of what remains unpatched and make sure you have measures in place to guard against exploits.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Tags Microsoftsecuritypatches & driversWindowssoftwareoperating systems

Upcoming

Slideshows

In Pictures: Houston, we have a bug - 9 famous software glitches in space

In Pictures: Houston, we have a bug - 9 famous software glitches in space

There’s never a good time to run into software bugs, but some times are worse than others - like during a mission to space. Spacecraft of all shapes and sizes rely heavily on software to complete their objectives. But those missions can be quickly ended by the simplest of human errors when writing code. The omission of an overbar here or overflow error checking code there can mean the difference between success or failure, not to mention the loss of hundreds of millions of dollars, years of work and, on manned missions, human life. Use the arrows above to read about 9 examples that show that, despite the care with which these systems are built, bugs have occurred in spacecraft software since we started to fling rockets into space - and will, no doubt, continue to crop up.

In Pictures: Houston, we have a bug - 9 famous software glitches in space
IN PICTURES: Windows 10 Sydney launch

IN PICTURES: Windows 10 Sydney launch

Tech lovers and party-goers alike headed down to Mrs Macquarie's Chair to be part of the world-first Windows 10 Launch Party. The night featured a presentation by Microsoft Australia managing director, Pip Marlow, DJs, live demonstrations and digital artistry by Lister.

IN PICTURES: Windows 10 Sydney launch

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments