WatchGuard Wire
Improve Your Security IQ
Microsoft Black Tuesday: Microsoft finally fixes Excel zero day, plus more
14 April 09 -- Today, Microsoft
released eight security bulletins, fixing 23 security vulnerabilities
in their products. They rate five of the bulletins as Critical, two as Important, and one as Moderate. The bulletins report details on:
- Flaws in five Windows components, three rated Critical
- An Internet Explorer (IE) cumulative patch, rated Critical
- An update to fix an unpatched Excel zero day, rated Critical
- DoS and XSS flaws in ISA Server, rated Important
Many of these bulletins fix vulnerabilities that could allow remote attackers to take over your computers, so you should apply the updates post haste. I would recommend starting with the Excel patch, which finally fixes a zero day vulnerability reported over a month ago. Attackers have actively exploited this flaw in the wild, so you'll want to fix it immediately. Next, install the IE cumulative patch. End users tend to get into a lot of trouble with their web browser, so you should keep IE up to date. Many of the Windows flaws also pose a critical risk, so apply those patches quickly as well. Finally, I'd save the ISA Server update for last. I suspect that few administrators even use this product if they use devices like the Firebox from WatchGuard.
As with all Microsoft fixes, you should also make sure to test the updates on non-production machines before deploying them throughout your network.
You can learn more about these security bulletins from the tables provided in Microsoft's
Bulletin Summary for April. Microsoft's tables (arranged in order of severity) link directly to this month's bulletins and patches. Expand the "Affected
Software and Download Location" section of the Summary to find a valuable table that will help you develop your own deployment strategy.
LiveSecurity and LiveSecurity Informer subscribers will receive more detailed information about most of these flaws, and how to fix them, in alerts
we're working on right now. However, most of our customers do not use ISA Server, so we will not alert on it. If you are interested in that update, see details in Microsoft's Security Bulletin. -- Corey Nachreiner, CISSP
Copyright© 2010 WatchGuard® Technologies, Inc. You may copy and distribute this article freely in any medium as long as you copy and distribute the entire article without change and preserve this copyright statement and notice.
|
