2 min
Patch Tuesday
Patch Tuesday - March 2018
There are a lot of fixes this month
[https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/6c8fa125-28f6-e711-a963-000d3a33a34d]
: Microsoft's updates include patches for 76 separate vulnerabilities, including
two critical Adobe Flash Player remote code execution (RCE) vulnerabilities
[https://helpx.adobe.com/security/products/flash-player/apsb18-05.html].
In fact all of this month's critical vulnerabilities are browser-related. This
is not surprising considering web brows
2 min
Patch Tuesday
Patch Tuesday - February 2018
It's a run-of-the-mill month as far as Patch Tuesdays go. Even so, 50 individual
CVEs have been fixed
[https://helpx.adobe.com/security/products/acrobat/apsb18-02.html] by Microsoft,
most of which (34) are rated "Important". As usual, most of the 14 considered
"Critical" are web browser vulnerabilities that could lead to remote code
execution (RCE). The most concerning non-browser issue is CVE-2018-0825
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0825]
, an RCE i
3 min
Patch Tuesday
Patch Tuesday - January 2018
The first Microsoft patches of 2018 came early, with new updates released late
Wednesday, January 3rd. Although this was due to the (somewhat
[https://www.freebsd.org/news/newsflash.html#event20180104:01]) coordinated
disclosure of the Meltdown and Spectre
[/2018/01/04/meltdown-and-spectre-what-you-need-to-know-cve-2017-5715-cve-2017-5753-cve-2017-5754/]
vulnerabilities, last week’s updates also contained fixes for 33 additional
CVEs. These days, Microsoft releases their OS updates as monolithi
6 min
Haxmas
HaXmas Review: A Year of Patch Tuesdays
Today’s installment of the 12 Days of HaXmas [/tag/haxmas] is about 2017’s 12
months of Patch Tuesdays [/tag/patch-tuesday/]. Never mind that there were only
eleven months this year, thanks to Microsoft canceling
[https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/]
most of February’s planned fixes. This coincided with when they’d planned to
[https://blogs.technet.microsoft.com/msrc/2016/11/08/furthering-our-commitment-to-security-updates/]
roll out their
2 min
Patch Tuesday
Patch Tuesday - December 2017
No big surprises from Microsoft this month
[https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/c383fa60-b852-e711-80dd-000d3a32f9b6]
, with 70% of the 34 vulnerabilities addressed being web browser defects. Most
of these are Critical Remote Code Execution (RCE) vulnerabilities, so
administrators should prioritize patching client workstations. It doesn't take
sophisticated social engineering tactics to convince most users to visit a
malicious web page, or a legitimate but
1 min
Patch Tuesday
Patch Tuesday - November 2017
Web browser issues account for two thirds of this month's patched
vulnerabilities
[https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/bae9d0d8-e497-e711-80e5-000d3a32fc99]
, with 24 CVEs for Edge and 12 for Internet Explorer being fixed. Many of these
are classified as Critical (allowing code execution without user interaction).
This is no surprise, as browser bugs are typically well represented on Patch
Tuesdays. On top of this are five Adobe Flash Player vulnerabilitie
2 min
Patch Tuesday
Patch Tuesday - October 2017
Patch Tuesday round-up for October 2017
1 min
Patch Tuesday
Patch Tuesday - September 2017
It's a big month, with Microsoft patching
[https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/5984735e-f651-e711-80dd-000d3a32fc99]
85 separate vulnerabilities including the two Adobe Flash Player Remote Code
Execution
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170013]
(RCE) fixes bundled with the Edge and Internet Explorer 11 updates. Continuing
recent trends, the bulk of Critical RCE vulnerabilities are client-side,
primarily in Edge, IE,
2 min
Microsoft
Patch Tuesday - June 2017
This month sees another spate of critical fixes
[https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/40969d56-1b2a-e711-80db-000d3a32fc99]
from Microsoft, including patches for a number of Remote Code Execution (RCE)
vulnerabilities. Two of these are already known to be exploited in the wild (
CVE-2017-8543
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8543]
and CVE-2017-8464
[https://portal.msrc.microsoft.com/en-US/security-guidance/advis
2 min
Microsoft
Patch Tuesday - May 2017
It's a relatively light month as far as Patch Tuesdays go, with Microsoft
issuing fixes for a total of seven vulnerabilities as part of their standard
update program. However, an eighth, highly critical vulnerability (CVE-2017-0290
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290]
) that had some of the security community buzzing over the weekend was also
addressed [https://technet.microsoft.com/en-us/library/security/4022344] late
Monday evening. A flaw in the
1 min
Microsoft
Patch Tuesday - April 2017
This month's updates deliver vital client-side fixes, resolving publicly
disclosed remote code execution (RCE) vulnerabilities for Internet Explorer and
Microsoft Office that attackers are already exploiting in the wild. In
particular, they've patched the CVE-2017-0199
[https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199]
zero-day flaw in Office and WordPad, which could allow an attacker to run
arbitrary code on a victim's system if they are able to successfully soc
0 min
Microsoft
February 2017 Patch Tuesday: Delayed
Earlier today Microsoft announced
[https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-update-release/]
that they will be delaying this month's security updates due to finding a
last-minute issue that could "impact some customers." This may be due to a
glitch in their new process
[/2017/02/06/a-reminder-about-upcoming-microsoft-vulnerability-content-changes]
that they were not able to iron out in time for today's planned release.
We will be keeping an eye out for any up
5 min
TLS Coverage Improvements in Nexpose 6.0.2
Over the last couple of years, some of the most serious and widely publicized
vulnerabilities have been related to the Transport Layer Security (TLS) protocol
and its predecessor, Secure Sockets Layer (SSL). Because TLS is so fundamental
to keeping network communications secure, new flaws that are discovered can have
a disproportionate effect on an organization's risk.
From Heartbleed [/2014/04/08/gaping-ssl-my-heartbleeds] to POODLE
[http://www.rapid7.com/resources/poodle.jsp], FREAK
[https://
5 min
Exploits
Oracular Spectacular
Nexpose version 5.9.10 includes significant improvements to its Oracle Database
fingerprinting and vulnerability coverage. When configured with appropriate
database credentials, Nexpose scans can accurately identify which patches have
been applied. This post will go through the steps for setting up such a scan, as
well as discuss some of the finer details about Oracle's versioning scheme and
the terminology around their quarterly Critical Patch Update program.
Scanning Oracle Databases with Nex
3 min
Nexpose
Using Nexpose to Stop the Bleeding (Scanning for the OpenSSL Heartbleed Vulnerability)
By now you have almost certainly heard about the recently disclosed OpenSSL
Heartbleed vulnerability [/2014/04/08/gaping-ssl-my-heartbleeds]
(CVE-2014-0160). The April 9th update for Nexpose includes both authenticated
and unauthenticated vulnerability checks for Heartbleed.
Scanning your assets with the regular full audit template, or indeed any
template that isn't tuned to exclude many ports or vulnerabilities, will
automatically pick up this vulnerability. But it is also possible to create