There we are: the last Patch Tuesday of 2015. It turns out to be about average, with maybe a bit more severity in the bulletins than usually. We have eight critical bulletins in the total 12, including one that fixes a 0-day vulnerability, currently in use by attackers to escalate privileges in Windows. 0-days used to be very rare occasions, but this year they have become almost mainstream. After all the year started off with a string of 0-days in Adobe Flash and since then we have seen almost every month a patch for a vulnerability that is already under attack. Definitely a sign of the increasing technical capabilities that attackers are wielding and a reminder that IT Managers should not only patch their systems promptly, but also look for additional robustness. Your list of things to look at in 2016 should include investigation of minimal software installs with the least features enabled, plus an additional piece software such as EMET that enhances robustness.

Continue reading …

And we are back to normal for Patch Tuesday November 2015. Twelve bulletins that cover a wide mix of products from Internet Explorer (MS15-112) to Skype (MS15-123). Last month’s lower number of six bulletins was an anomaly caused by, maybe, the summer vacation? What is not an anomaly but the product of serious security engineering is the pronounced difference between Internet Explorer and Edge patches.

Continue reading …

Patch Tuesday October 2015 turns out to be a light edition. There are only six bulletins, but all of the important products are covered. We have a critical bulletin for Internet Explorer (but not for Edge), a bulletin for Office that has Remote Code Execution (RCE) vulnerabilities, plus Windows Kernel vulnerabilities that allow for Privilege escalation. Plus an interesting issue in Windows shell that allows for RCE as well. Pretty much everybody, meaning all versions of Windows and Office, are affected except this month there are none of the additional software packages with updates (.NET, server software, etc).

Continue reading …

Today Microsoft addressed a 0-day vulnerability in Internet Explorer in an out-of-band update described MS15-093. The vulnerability CVE-2015-2502 is actively being exploited in the wild. The attack code is hosted on a malicious webpage that you or your users would have to visit in order to get infected. Attackers use a number of mechanisms to increase their target reach and lure users to the webpage  including:

Continue reading …

Update: HP clarified that the vulnerabilities apply only to Internet Explorer Mobile for the Windows phone.

Original: HP’s Zero Day Initiative (ZDI) just published four critical 0-day vulnerabilities in Internet Explorer: ZDI-15-359, 360, 361 and 362. All of them can result in Remote Code Execution. Microsoft overstayed the 120 day fix limit that ZDI enforces on such vulnerability disclosures.

It is unlikely that exploit code exists at the moment and difficult to reverse engineer the vulnerabilities as details are sparse. There is not much you can do at the moment, except refrain from using Internet Explorer. Stay tuned for updates.

Update: Eugene Kaspersky (@e_kaspersky) just blogged about an advanced malware that attacked his company (and a number of others) using a Windows Kernel vulnerability CVE-2015-2360, which Microsoft addressed this month in MS15-061. He calls the malware Duqu 2.0 and affirms that it is backed by a nation state, due to characteristics of the malware’s code. The code bears resemblance to Duqu and incorporates several new features that show that it has received development efforts since the initial version in 2011. There is more information forthcoming – we will update this blog post when that happens. In the meantime make sure you apply MS15-061 to all of your Windows machines.

Original: Patch Tuesday June 2015 – halfway through the year and this month we have eight bulletins bringing the total count for the year to 63. Four of the bulletins address Remote Code Execution (RCE) vulnerabilities, and one covers a publicly disclosed kernel vulnerability that has not seen any exploits yet. Weirdly enough there is a "hole" in Microsoft’s lineup and one bulletin, MS15-058, is apparently not ready to be released yet.

Continue reading …

Today is Patch Tuesday May 2015, and it is coming on strong. Microsoft released 13 bulletins bringing the count for this year to 53. 53 is quite a bit higher than in any of the last five years, in fact I cannot remember a similar active year. Our internal tracking of vulnerability numbers now projects north of 140 advisories for this year, certainly also new record:

Continue reading …

Last week we finished our analysis for the Top 10 most prevalent vulnerabilities for the trailing three months: November and December 2014 and January 2015. We perform this analysis periodically to provide the market an overview of one of the items in our Laws of Vulnerabilities Research: the Prevalence of Vulnerabilities.

You can use the data to enrich your own Vulnerability Management practice. We think it makes sense to take a look at the listed vulnerabilities and see how you compare.

Continue reading …

February Patch Tuesday 2015 comes after a quite turbulent month for information security professionals. Not so much Microsoft, but Adobe has been keeping us busy with multiple disclosed 0-day vulnerabilities their Flash software. All of the known issues have been very quickly addressed by Adobe (APSB15-02, 03 and 04), typically turning around a fix in less than a week. Still, it is worrisome to see the amount of problems that cyber criminals are able to find in software that we all have installed and use in our daily lives.

Continue reading …

It is December, time for our last Patch Tuesday of the year. Microsoft is publishing seven bulletins this month bringing the total count for the year to 85. Compared to 2013 with 106 and 2011 with 100 bulletins, 85 bulletins is not particularly high.

Continue reading …