December's Patch Tuesday brings Microsoft's total to 99 bulletins in 2011.
Joshua Talbot, security intelligence manager for Symantec Security Response, said the most important patch this month is the TrueType Font Parsing issue, which is the zero-day vulnerability exploited as part of the Duqu targeted attacks.
"The Duqu malware didn't actually incorporate an exploit for this issue in its code, but the vulnerability was used by malicious e-mail attachments to load Duqu onto targeted systems," he explained.
Symantec typically puts Internet Explorer cumulative updates pretty high on its priority list, Talbot added, but this month none of the IE vulnerabilities are particularly high-impact issues.
"They're still important, but we suggest prioritizing quite a few of the other bulletins ahead of them. For example, the Windows Media Player DVR-MS memory corruption issue," Talbot said. "This one looks pretty simple to exploit and can result in a complete system takeover. To make matters worse, [data execution prevention] and [address space layout randomization] only offer limited protection here."
No Out-of-Band Patches in 2011
Andrew Storms, director of security operations at nCircle, noted that it's been a long time since Microsoft pulled a bulletin at the last minute. Microsoft pulled the Beast fix because of a bad interaction with a high-profile vendor.
"This last minute change highlights the extensive testing Microsoft does during the patch releases. A bad patch makes for the worst sort of IT heartburn," Storms said. "I'm sure we'll see the 'Beast' bulletin in the January patch, and waiting a little longer for a fix shouldn't be much of an issue because it's fairly difficult to take advantage of this bug."
Although anything could happen in the next two weeks, Storms pointed out that Microsoft appears to have made it through 2011 without having to issue an out-of-band patch. In fact, he added, the year has been marked by lower severity ratings for all vulnerabilities.
"The new, improved risk mitigation technologies in Windows 7 and IE9 just might make out-of-band Microsoft patches a thing of the past," Storms said, "and that would be the best holiday gift Microsoft could give."
Total Patch Count Declines
Considering the previous years of Microsoft patches, this is not a bad way to end the year, said Paul Henry, a security and forensic analyst and blogger at Lumension. Microsoft released 17 bulletins in the 2010 December Patch Tuesday. Microsoft's total patch count, 99, is also down in 2011, from 106 in 2010.
"Clearly Microsoft has dramatically improved its software processes and this is reflected in the continued decline of vulnerabilities considered critical in the current codebase," Henry said. "The numbers speak volumes on the improvements from Microsoft. In 2006, 70 percent of security patches were critical and in 2011 critical vulnerabilities fell to just 30 percent. In an otherwise volatile threat landscape, this is good news for everyone."
There are no comments yet