Santa Microsoft has come to town with a bag full of software updates for all the nice Windows administrators out there. I recommend you download, test, and install them as soon as possible. That way you can enjoy a merry, stress-free, and secure Christmas this year.
According to their summary post, Microsoft released 13 security bulletins today — one less than the 14 they originally intended. The bulletins cover flaws in Windows and its components, Office and related products, and Internet Explorer (IE). Microsoft rates three of the bulletins as Critical.
As is often the case, the Critical Microsoft bulletins fix vulnerabilities that remote attackers could exploit to execute malicious code on your machine, with little user interaction. One of the Critical updates, MS11-087, fixes the zero day kernel-mode driver vulnerability that attackers have leveraged in the wild via the well-publicized Duqu malware. Though attackers seem to have only leveraged this malware in limited, highly-targeted attacks, I still recommend you patch it first. In fact, you should probably focus on applying all of Microsoft’s three Critical updates quickly, followed by the Important ones.
You can learn more about today’s updates in Microsoft’s December summary bulletin. As is normally the case with Microsoft updates, I suggest you test the patches before deploying them in your production network — especially the ones that affect server software.
I’ll post more detail, consolidated alerts here shortly. Stay tuned. — Corey Nachreiner, CISSP (@SecAdept)