Switchfast Blog: The Future of IT
Another Heavy Tuesday – Critical Patches from Microsoft, Adobe
Tuesday, April 13, 2010 by Bryan Anderson
Only two weeks after an out-of-band patch, Microsoft issued its April patches, including 11 bulletins and 25
vulnerabilities. Adobe also got in on the action, plugging 15 holes
which could be found in Reader and Acrobat. Not to be left out,
Oracle had also scheduled to release a critical patch update that
includes up to 50 fixes covering hundreds of products.
Here are the top three bulletins Microsoft recommends as
priorities, according to CNET.com:
- MS10-019, which affects all versions of Windows and would allow
an attacker to alter signed executable content without invalidating
the signature
- MS10-026, which is critical on Windows 2000, XP, Server 2003
and Server 2008, and could allow an attacker to take complete
control if a victim were to open a malicious AVI (Audio Video
Interleave) file or had it stream from a Web site
- MS10-027, which affects Windows 2000 and XP users and could be
triggered if they visited a malicious Web page, according to
its bulletin summary.
With so many critical updates happening at once, are we
approaching "patch overload"?
An article over at informationweek.com talks to
Wolfgang Kandek, CTO of Qualys, who suggests the silent, automatic
updates as 'more necessary' over pushing several zero-day flaws. He
points out, however, that "this will require a change in the way we
look and manage computers... Organizations will have to endorse and
embrace that move for real impact."
Over at CNET.com, Elinor Mills spoke with Joshua Talbot,
security intelligence manager at Symantec Security Response, who
said that "with the large number of patches, automating the
patching process becomes even more critical to ensure that nothing
slips through the cracks."
"This is going to be quite the month for IT administrators."
Included in Microsoft's patches is a bulletin for a Windows 7 bug. The
fascination with this patch is that Microsoft has claimed the flaw
to be "unhackable" or "can't be exploited."
The bottom line: There's a flaw but Microsoft has no idea how to
exploit it - therefore, better safe than sorry.
Maybe one of these guys knows how to do it - let's just
hope the best ones are fighting for the good guys.
Until Next Time -
Matthew Hymel
Switchfast Technologies
Chicago IT Support &
Consulting
Rochester
IT Support & Consulting
Leave comment: