Apple Patches Flaws in OS X, iOS, Other Products

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLQPDGlY6gHUP3-deGcANYt_ANNsBxRoE-v_axz3pgOjVHtFJkBv__ue92HVXXosFVTSdRdEAXdt_klrXfEEWhmYVsOgNQEU-cD3xlIv6MpZSCRlsdrWgtXrGAVnJSUH-GNge0eKdDGXs/s1600/ios-malware-hack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLQPDGlY6gHUP3-deGcANYt_ANNsBxRoE-v_axz3pgOjVHtFJkBv__ue92HVXXosFVTSdRdEAXdt_klrXfEEWhmYVsOgNQEU-cD3xlIv6MpZSCRlsdrWgtXrGAVnJSUH-GNge0eKdDGXs/s640/ios-malware-hack.jpg" width="640" /></a></div> <br /> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A series of software updates released by Apple on Wednesday address tens of vulnerabilities in iOS, OS X, Safari, iTunes, Xcode, watchOS and OS X Server.</span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><a href="https://support.apple.com/en-us/HT205375" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">OS X El Capitan v10.11.1</a> patches 60 vulnerabilities affecting components such as SecurityAgent, Script Editor, Sandbox, OpenSSH, OpenGL, Net-SNMP, libarchive, the kernel, IOAcceleratorFamily, ImageIO, the NVIDIA graphics driver, Grand Central Dispatch, FontParser, bookmarks, Disk Images, CoreText, CoreGraphics, configd, CFNetwork, Bom, Audio, ATS, PHP, and the Accelerate Framework.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The weaknesses patched in El Capitan 10.11.1 can be exploited for arbitrary code execution, denial-of-service (DoS), information disclosure, privilege elevation, overwriting arbitrary files, and bypassing restrictions.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Apple has also released EFI updates for OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan 10.11 to patch a flaw that allows malicious actors to “exercise unused EFI functions” (CVE-2015-7035). Corey Kallenberg, Xeno Kovah, John Butterworth, and Sam Cornwell have been credited for reporting the issue. It’s worth noting that this is not the first time Kallenberg and Kovah have been acknowledged for finding Mac EFI vulnerabilities.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While most of the issues patched in the latest version of OS X were identified by Apple’s own security team, John Villamil of the Yahoo Pentest Team has also been credited for finding more than a dozen vulnerabilities. The researcher Luca Todesco, who in August released an OS X zero-day, was also credited for three of the resolved flaws.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">With the release of <a href="https://support.apple.com/en-us/HT205370" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">iOS 9.1</a>, Apple fixed nearly 50 vulnerabilities, many of which have also been addressed in OS X. One of the issues patched in both iOS and OS X is an information leakage flaw related to the handling of cookies presented this summer by a team of researchers at the USENIX Security Symposium.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The latest version of Apple’s mobile operating system also resolves two vulnerabilities used by Pangu Team for jailbreaks, and a lock screen weakness that causes phone and message notifications to appear on the screen even when the option is disabled.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Since watchOS, the operating system powering the Apple Watch, is based on iOS, some of the issues addressed in iOS 9.1 have also been fixed in watchOS 2.0.1. The only vulnerability specific to watchOS is an Apple Pay security bug that exposes recent transaction information.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Safari 9.0.1 brings a series of WebKit fixes that could allow an attacker to execute arbitrary code by tricking the victim into visiting a malicious website. The same flaws were also addressed in iTunes 12.3.1 for Windows, along with three memory corruption issues found by Yahoo’s Villamil.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Apple has patched a vulnerability with the release of Xcode 7.1 and three flaws with the release of OS X Server 5.0.15.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Last week, Apple released updates for its Keynote, Numbers, and Pages productivity apps to patch a total of four vulnerabilities, including input validation and memory corruption issues.</span></span></div> </div><br> <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script> <!-- ht.net post --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-7726750987177406" data-ad-slot="7596682374" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script> <br>

ios9 Latest News Patched Patches Security news Apple Patches Flaws in OS X, iOS, Other Products

A series of software updates released by Apple on Wednesday address tens of vulnerabilities in iOS, OS X, Safari, iTunes, Xcode, watchO...

Read more »

Oracle Patches Java Zero-Day Exploited by Pawn Storm Attackers

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBGJ55rgmxP8FlIH3Db3EDDhbx0zdbN485qvGfSRWMoDN1UIuR4VGlNF89-yw4x-San4jyxJEpudjjY-MOm5p0HoAQO4xBYkwfgmcdbDy0zDYWCeQ4rnduyIR9CcAObjyC_3jNp3NvDZ0/s1600/Oracle-Patches-Java-Zero-Day-Exploited-by-Pawn-Storm-Attackers.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="352" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBGJ55rgmxP8FlIH3Db3EDDhbx0zdbN485qvGfSRWMoDN1UIuR4VGlNF89-yw4x-San4jyxJEpudjjY-MOm5p0HoAQO4xBYkwfgmcdbDy0zDYWCeQ4rnduyIR9CcAObjyC_3jNp3NvDZ0/s640/Oracle-Patches-Java-Zero-Day-Exploited-by-Pawn-Storm-Attackers.gif" width="640" /></a></div> <br /> <br /> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Oracle has patched a Java zero-day exploited by the Russia-linked advanced persistent threat (APT) group known as “Pawn Storm” in attacks aimed at NATO member countries and the White House.</span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The vulnerability, reported to Oracle by Trend Micro, was used earlier this year in conjunction with a different Java zero-day by the Pawn Storm attackers. The threat group leveraged a remote code execution vulnerability in Java (CVE-2015-2590), which Oracle patched with the July 2015 Critical Patch Update (CPU), and a different Java weakness (CVE-2015-4902), which Oracle addressed on Tuesday with the October 2015 CPU.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The attackers used the flaw identified as CVE-2015-4902 to bypass the click-to-play protection in Java.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In recent years, several steps have been taken to prevent the exploitation of Java vulnerabilities: Oracle started releasing updates more often, browser vendors blocked outdated Java versions, rules have been tightened for the execution on self-signed and unsigned applets, and a click-to-play protection was introduced for all applets.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In attacks aimed at NATO members and the White House, the Pawn Storm threat group leveraged both CVE-2015-2590 and CVE-2015-4902. The first issue was detailed by Trend Micro in July, shortly after the attacks were spotted, and now that Oracle has resolved the <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/new-headaches-how-the-pawn-storm-zero-day-evaded-javas-click-to-play-protection/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">click-to-play bypass flaw</a>, the security firm disclosed its details as well.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The click-to-play bypass vulnerability allowed attackers to execute malicious Java code without any alerts being shown to the victim.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“If Java was still in widespread use today, the effects of a bypass of click-to-play protection would be far-reaching. Any zero-day vulnerability discovered down the road would allow for drive-by downloads to be carried out,” Trend Micro threats analyst Jack Tang explained in a blog post. “This case also highlights the importance of ensuring that when new security features (such as click-to-play) are introduced to a complex system like Java, it is a must to audit the communications of existing components with the new features. This is to ensure that existing ‘good’ features and security are not lost in the mix.”</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Pawn Storm cyber espionage group (also known as Sednit, APT28, Fancy Bear, Sofacy and Tsar Team) has been around since at least 2007, focusing its operations on government, military, media, and defense organizations from across the world.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Pawn Storm has used at least half a dozen zero-day vulnerabilities in the last year, including flaws affecting Java, Windows and Flash Player. Trend Micro reported last week that the group had leveraged an Adobe Flash Player zero-day (CVE-2015-7645) in attacks aimed at several Foreign Affairs Ministries. Adobe patched the weakness within a few days after its existence came to light.</span></span></div> </div> <br> <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script> <!-- ht.net post --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-7726750987177406" data-ad-slot="7596682374" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script> <br>

Hacking news Latest News Patched Patches Security news Oracle Patches Java Zero-Day Exploited by Pawn Storm Attackers

Oracle has patched a Java zero-day exploited by the Russia-linked advanced persistent threat (APT) group known as “Pawn Storm” in atta...

Read more »

Oracle Fixes 154 Flaws With Critical Patch Update

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6-WimogtceYrKIZmxkQrtSQ5e9vjFhnDATj4Ff2BjI2plBK367YcmRvXs6SSEaCbsM6uXU6nxa-BK2pUWGzH8l3L5ktLv5kI2rFw6JsOxZFbVE8lrUlP95aag5s9bPR8B8ewuULMXhUQ/s1600/Oracle-Fixes-154-Flaws-With-Critical-Patch-Update.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6-WimogtceYrKIZmxkQrtSQ5e9vjFhnDATj4Ff2BjI2plBK367YcmRvXs6SSEaCbsM6uXU6nxa-BK2pUWGzH8l3L5ktLv5kI2rFw6JsOxZFbVE8lrUlP95aag5s9bPR8B8ewuULMXhUQ/s640/Oracle-Fixes-154-Flaws-With-Critical-Patch-Update.gif" width="640" /></a></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Oracle’s Critical Patch Update (CPU) for October 2015, released on Tuesday, resolves a total of 154 vulnerabilities affecting tens of the company’s products.</span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to Oracle, the latest CPU patches security holes in Database Server, Fusion Middleware, Hyperion, Enterprise Manager, E-Business Suite, Supply Chain Products Suite, PeopleSoft Enterprise, Industry Applications, Java SE, Sun Systems, Pillar Axiom, VM VirtualBox, and MySQL.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The <a href="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">October 2015 CPU</a> resolves eight vulnerabilities affecting Oracle Database, one of which has a CVSS score of 10 (CVE-2015-4863), which indicates that it can be exploited remotely without authentication.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">As usual, many of the fixes are for Java SE. On this occasion, Oracle patched 25 issues, most of which can be exploited remotely without authentication. The company noted that 20 of the vulnerabilities only affect Java running in web browsers.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">One critical issue, with a CVSS score of 10, was also patched in the Oracle Sun Systems Products Suite (CVE-2015-4915). The vulnerability affects the Integrated Lights Out Manager (ILOM) service processor used by multiple products. Oracle has advised customers to apply the available patches and ensure that the ILOM interface is not accessible from the Web.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A total of 23 security bugs have been patched in Fusion Middleware, 16 of which are remotely exploitable without authentication. Industry Applications received 14 fixes, including nine for Communications Applications, and four for Retail Applications.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Five of the new fixes are for Oracle Enterprise Manager Grid Control, one is for Hyperion, twelve for E-Business Suite, eight for Supply Chain Products Suite, eight for PeopleSoft Enterprise, and one for Siebel CRM.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Due to the severity of a number of vulnerabilities fixed in this Critical Patch Update, Oracle recommends that the necessary patches be applied as soon as possible,” Eric Maurice, director of Oracle's Software Security Assurance group, wrote in a <a href="https://blogs.oracle.com/security/entry/october_2015_critical_patch_update" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">blog post</a>. “As of October 19th, the company’s security team didn’t have any indication that any of the most severe vulnerabilities fixed in this Critical Patch Update had been successfully exploited ‘in the wild’. However, it is our experience that malicious actors will often attempt to reverse-engineer fixes to develop exploit code in an attempt to attack organizations lagging behind in their patching effort.”</span></span></div> </div><br> <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script> <!-- ht.net post --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-7726750987177406" data-ad-slot="7596682374" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script> <br>

Latest News Patched Patches Security news Oracle Fixes 154 Flaws With Critical Patch Update

Oracle’s Critical Patch Update (CPU) for October 2015, released on Tuesday, resolves a total of 154 vulnerabilities affecting tens o...

Read more »

Microsoft Patches Critical Flaws in Windows, Internet Explorer

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwVJrEsp5J-PuJev19aIGaAUku87Eoj4wJwzRTZfIHYZoyQe5MveNdzCGYPht2bn3PGRVQTQi7oFklMmdQMCQpe_7eht9j83bMeZ-080keNYVjbsIlbl0Hhr0SCeAAxHv3kZuXHls7duQ/s1600/Microsoft-Patches-Critical-Flaws-in-Windows%252C-Internet-Explorer.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwVJrEsp5J-PuJev19aIGaAUku87Eoj4wJwzRTZfIHYZoyQe5MveNdzCGYPht2bn3PGRVQTQi7oFklMmdQMCQpe_7eht9j83bMeZ-080keNYVjbsIlbl0Hhr0SCeAAxHv3kZuXHls7duQ/s640/Microsoft-Patches-Critical-Flaws-in-Windows%252C-Internet-Explorer.gif" width="640" /></a></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The six security bulletins released by Microsoft for October 2015 address more than 30 vulnerabilities affecting Windows, Internet Explorer, Edge, and Office.</span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">One of the <a href="http://blogs.technet.com/b/msrc/archive/2015/10/13/october-2015-security-update-release-summary.aspx" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">bulletins</a> rated critical is MS15-106, which resolves a total of 14 vulnerabilities in Internet Explorer. The list of flaws includes memory corruption, privilege escalation, information disclosure, and VBScript and JScript ASLR bypass issues impacting Internet Explorer and the scripting engine.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The most serious of the security holes patched with this bulletin can be exploited by a remote attacker for arbitrary code execution by tricking the targeted user into viewing a specially crafted webpage via Internet Explorer.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Another bulletin that has been rated “critical” is MS15-108, which patches information disclosure, memory corruption, and ASLR bypass vulnerabilities in the VBScript and JScript scripting engines in Windows.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A bulletin that addresses remote code execution flaws in Windows has also been classified as having critical severity. The bugs are caused due to the way Windows Shell and the Microsoft Tablet Input Band handle objects in memory.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The bulletins rated “important” fix weaknesses in Edge, Office, and the Windows kernel. The flaws can be leveraged for information disclosure and remote code execution.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to Microsoft, there is no evidence that any of these vulnerabilities have been exploited in the wild.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“It’s official, a record has been set for the most bulletins released by Microsoft in a single year. In 2013, we saw 106 bulletins released, this month we hit 111 for 2015 and we still have two Patch Tuesdays left,” said Tyler Reguly, manager of security research at Tripwire.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“This month's updates are pretty ho-hum, we've got a list of entirely typical updates. Given that this month is so light, it'll be interesting to see what November has in store for us. That said, sys admins shouldn't take the light month to mean they can sit back and take a break. We still have a number of vulnerabilities that should be patched, so updates should be applied following regular schedules.” </span></span><span style="font-family: 'trebuchet ms', geneva; font-size: small;">Reguly told <em>SecurityWeek</em>. </span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Microsoft, Google and Mozilla announced in September their intention to kill the RC4 cipher stream in their web browsers at the beginning of 2016. On Tuesday, Microsoft took further steps in this direction by <a href="https://technet.microsoft.com/library/security/2960358" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">disabling RC4</a> in the .NET Transport Layer Security (TLS) on Windows 10 systems running .NET 3.5 applications, and systems with .NET Framework 4.6 that are running .NET 4.5, 4.5.1 and 4.5.2 applications.</span></span></div> <div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;"> <span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Adobe also released security updates on Tuesday to patch a total of nearly 70 vulnerabilities affecting Flash Player, Reader and Acrobat. Shortly after the release of the patches, news broke that malicious actors have been exploiting a Flash Player zero-day in their attacks.</span></span></div> </div> <br> <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script> <!-- ht.net post --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-7726750987177406" data-ad-slot="7596682374" data-ad-format="auto"></ins> <script> (adsbygoogle = window.adsbygoogle || []).push({}); </script> <br>

Latest News Patches Security news Microsoft Patches Critical Flaws in Windows, Internet Explorer

The six security bulletins released by Microsoft for October 2015 address more than 30 vulnerabilities affecting Windows, Internet Exp...

Read more »