Internet Explorer flaws fixed by Microsoft Patch Tuesday updates

By , Network World |  Security, Internet Explorer, java

Microsoft says Internet Explorer versions 6 through 10 are subjects of two critical Patch Tuesday updates for February that could address recent Java woes.

Both critical patches address vulnerabilities that could give attackers access to client browsers and from there access to the underlying host, says Alex Horan a senior product manager at CORE Security. "Bulletins 1 and 2 target all versions of Internet Explorer on essentially all versions of Windows platforms, so it's pretty much one-hack fits all in the Windows environment for attackers," he says. "I expect a lot of interest in developing a working exploit for this vulnerability."

[NEWS: Microsoft launches campaign against Gmail over privacy 

HELP: 11 (FREE!) Microsoft tools to make life easier 

NAVIGATE: 12 essential Windows 8 keyboard shortcuts]

Three less urgent patches ranked important could address flaws that enable the takeover of machines accessed via the Internet Explorer vulnerabilities, he says. "Bulletins 7, 8 and 9 seem to target the same underlying systems as Bulletins 1 and 2, which means hackers could phish users and then leverage 7, 8 and 9 to get system level control of their machines. That is essentially a worst case scenario and knockout punch for security personnel," Horan says.

Another security expert Paul Henry, a security and forensic analyst for Lumension, says the two critical Internet Explorer problems could be linked to Java. "It's possible that this is related to the recent and ongoing Java issues," he says. "Microsoft has a very close relationship with Oracle, so it wouldn't surprise me if these bulletins include Java patches."

Regardless, they put unpatched machines in danger of falling to remote code execution exploits, Microsoft says, and may require restarting affected machines, something that will make installing the patches a longer exercise.

There are 12 patches in all this month, an uptick from the past few months, and they affect a wide range of Windows platforms from Windows XP to Windows RT, the new Windows 8 tablet operating system that runs on ARM processors. "It's never a good sign when your current code base is impacted," Henry says. This month's 12 patches is the highest number since June 2011 when there were 16.


Originally published on Network World |  Click here to read the original story.
Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

SecurityWhite Papers & Webcasts

See more White Papers | Webcasts

Answers - Powered by ITworld

Ask a Question
randomness