Microsoft has released a number of critical security patches for various vulnerabilities. Let’s try to clarify some important updates of security-related software. Most of these flaws belong to Internet Explorer with others found in Microsoft Office programs.
One of the updates is ‘Cumulative Security Update for Internet Explorer (3032359)’, which helps fixing vulnerabilities in the browser. Vulnerabilities could allow remote execution if users access some specific hazardous website through Internet Explorer. This update resolves certain vulnerabilities in Internet Explorer. It is rated ‘critical’ and updates apply to all versions from IE 6 to 11 for both Windows client and server operating system. This patch helps to fix the vulnerabilities by modifying the way Internet Explorer handles objects in memory as well as modifies the way script engine handles an object in memory and also provides additional permission validation to Internet Explorer.
Vulnerability in Schannel could allow security feature bypass, when any Windows machine is using Schannel to connect to the remote TLS server with an insure cipher. This vulnerability could allow a man-in-the-middle attackers to force the downgrading of the length of the RSA key to EXPORT-grade length in a TLS connection. It is fixed by correcting the Cipher suite enforcement policies when several keys are exchanged between the server and client machines. It applies to the machines with server operating systems Windows 2003 and later, it also applies to client operation system Windows Vista and later.
Also peculiar are the Microsoft Windows vulnerabilities which could allow remote code execution when a user accesses a specific vulnerable website or uses a vulnerable file, etc. This is fixed by correcting the way in which ‘Microsoft Text Services’ handles objects in memory and how Microsoft Windows loads the DLL files. This fix applies to the machines with server operating systems Windows 2003 and above, it also applies to client operation system Windows Vista and later.
Vulnerabilities in Microsoft Office are quite common. They allow remote code execution that occurs when users open a specific vulnerable file. Users with administrators / full control access are at risk, which is mitigated if users have minimal local permissions. This is a critical update and needs to be installed for MS Office 2007, 2010 and 2013.
Since these vulnerabilities can be a huge threat to organization’s security, it is recommended to apply these fixes: this can help you, to a great extent, keep your environment clean from some of the security threats. Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager help administrators distribute security updates. You could also run Microsoft Baseline Security Analyzer (MBSA) to scan local and remote systems for missing security updates and common security misconfigurations and then apply the security patches.
