Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    December 2014
    S M T W T F S
    « Nov    
     123456
    78910111213
    14151617181920
    21222324252627
    28293031  
  • Email Subscription

  • About Us

    Patch-Tuesday_gray
    The last Patch Tuesday of the year features 11 bulletins, with five rated as Critical and the remaining as Important. This month’s release addresses a notable zero-day vulnerability that was used in attacks. The particular bulletin—MS13-096—was noticeably absent in last month’s Patch Tuesday. As previously reported, attackers took advantage of the vulnerability by embedding .DOC files with malicious .TIFF files to gain account privileges.

    Unfortunately, another zero-day vulnerability remains unpatched. Microsoft earlier that a security fix for the escalation of privilege vulnerability (CVE-2013-5065) was not included in this month’s security releases.  Thus, recommendations and workarounds suggested at that time of its discovery remain in effect. Trend Micro Deep Security has been protecting users from threats exploiting this vulnerability via the rule 1005801 – Microsoft Windows Kernel Elevation Of Privilege Vulnerability (CVE-2013-5065) since its discovery.

    The remaining Critical bulletins addresses vulnerabilities in Microsoft Windows, Internet Explorer, and Microsoft Exchange. These may allow remote code execution if exploited by attackers.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page. Trend Micro Deep Security protects customers from threats via the following rules:

    • 1005805 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5047)
    • 1005806 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5048)
    • 1005807 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5049)
    • 1005808 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5051)
    • 1005809 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5052)
    • 1005764 — Microsoft Graphics Component Remote Code Execution Vulnerability (CVE-2013-3906)
    • 1005812 — Microsoft Scripting Runtime Object Library Use-After-Free Vulnerability (CVE-2013-5056)
    • 1005815 — Microsoft WinVerifyTrust Signature Validation Vulnerability (CVE-2013-3900)
    • 1000552 — Generic Cross Site Scripting(XSS) Prevention




    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   del.icio.us   StumbleUpon




    Comments are closed.



     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice