Microsoft on Tuesday issued its December security update. After a light Patch Tuesday in November, security administrators have their hands full this month. The 2007 finale addressed 11 vulnerabilities altogether in seven patches.
Specifically, the release contains three “critical” and four “important” updates, including two that patched “zero day” vulnerabilities, one involving Internet Explorer and the other involving Macrovision. Critical patches also fixed vulnerabilities in DirectX and Windows Media.
Weakest I.T. Security Link
The three critical patches all address remote-code execution and should be rolled out as quickly as possible, according to Paul Zimski, senior director of market strategy at Lumension Security. That’s because the vulnerabilities are Web-based, and hackers can prey on unsuspecting users by dropping malicious code into videos and other media on legitimate Web sites.
“This is particularly troublesome because attackers can prey on users as the weakest I.T. security link by posting seemingly harmless videos on YouTube, MySpace, Facebook, or similar sites,” Zimski said. “If a user watches one of these infected videos, malware will execute, compromise their machine, and put the entire network at risk.”
The critical vulnerabilities, he added, could also be exploited directly through Web-based mail, allowing hackers to slip under the radar screen by targeting individual users or user groups.
Hodgepodge of Patches
Indeed, three of the seven patches impact the “rich Web” audio-visual experience. That indicates a change from attachment-based malware to drive-by attacks that require very little user interaction, explained Andrew Storms, director of security operations for nCircle.
“Users now are less prone to open e-mail attachments that can be loaded with malware,” he noted, “but are less likely to be concerned with malware delivered through Web sites and media players.”
Of seven total security bulletins issued this month, five apply to Windows Vista. “It appears the Vista users are still in the same boat with…