Microsoft issues patch plans, includes Internet Explorer fix
Microsoft on Thursday posted its plans for next week's Patch Tuesday.Nine bulletins are expected to be issued to address 21 vulnerabilities, with four labeled "critical" and the rest "important." The four critical fixes are intended to correct flaws that could allow remote code execution in Windows, Internet Explorer, .NET Framework, and Silverlight, Microsoft's web development tool.
"Important" patches are expected to be issued to address bugs in the Office suite, as well as server software, that could grant privilege escalation to attackers, which gives them authorization permissions beyond what was intended.
Wolfgang Kandek, CTO at vulnerability management firm Qualys, said the critical update to Internet Explorer should receive the highest priority, as criminals are ramping up their use of browser-based attacks.
"A couple of years ago, email was the most prevalent method of attack," Kandek told SCMagazine.com on Thursday. "Today, it is web browsers."
To illustrate his point, he referenced a vulnerability that was patched Jan. 10 by Microsoft, but was exploited roughly two weeks later. The attack was delivered through the browser and involved a malicious audio file played via the Windows Media Player.
As usual, Microsoft advised users to apply these patches via Microsoft Update, Windows Update and the Microsoft Download Center to keep their software up to date. Mac users can receive uploads automatically with Microsoft AutoUpdate for Mac, available here.
