Menu
Microsoft fixes critical flaws in Windows, Office, Edge, IE and other products

Microsoft fixes critical flaws in Windows, Office, Edge, IE and other products

The company published 9 security bulletins covering patches for 24 vulnerabilities

Microsoft has released the first batch of security updates for 2016 and they include critical fixes for remote code execution flaws in Windows, Office, Edge, Internet Explorer, Silverlight and Visual Basic.

The company has also fixed remote code execution and elevation of privilege vulnerabilities in Windows and an address spoofing flaw in Exchange Server, that were rated important, not critical, due to various mitigating factors.

In total, Microsoft issued 9 security bulletins covering patches for 24 vulnerabilities.

According to Wolfgang Kandek, the CTO of security firm Qualys, administrators should prioritize the MS16-005 security bulletin, especially for systems running Windows Vista, 7 and Server 2008.

This patch addresses a remote code execution vulnerability tracked as CVE-2016-0009 that has been publicly disclosed, making attacks more likely.

The second most important bulletin, according to Qualys, is MS16-004, which addresses six vulnerabilities in Microsoft Office. This bulletin is rated critical, which has been unusual for Microsoft Office in the recent past.

The culprit for this severity rating is one particular remote code execution vulnerability tracked as CVE-2016-0010 that's present in all versions of Office from 2007 to 2016, even those running on Mac and Windows RT, Kandek said in a blog post.

Researchers from security firm Tripwire believe that the Internet Explorer and Microsoft Edge patches should be at the top of the priority list instead, because they address vulnerabilities that could be remotely exploited through malicious or compromised websites.

These patches are covered in the MS16-001 and MS16-002 security bulletins and will be the last ones that Internet Explorer versions 8 and 10 will ever receive. IE 9 will continue to be supported on Windows Vista and Windows Server 2008 SP2.

"Many enterprises need to use older versions of IE within their environments because of very expensive, legacy web applications that use outdated technology," said Lane Thames, security researcher at Tripwire, via email. "Organizations who still depend on legacy applications that require these older IE versions will need to move appropriately."

Companies that use Outlook Web Access (OWA) should also prioritize MS16-010. Even though this bulletin is rated by Microsoft only as important, the vulnerability it covers can allow attackers to launch so-called business e-mail compromise (BEC) attacks.

Such attacks have cost companies around the world $1.2 billion, according to statistics published in August by the FBI's Internet Crime Complaint Center (IC3). It involves attackers compromising business emails, or spoofing email addresses, to instruct employees and business partners to initiate unauthorized wire transfers.

Finally, the MS16-006 bulletin, which addresses a vulnerability in Silverlight, should be on the priority list as well because the flaw could enable remote code execution attacks through the browser plug-in. Attackers are known to have used Silverlight exploits in the past.

This month's updates were also the last ones for Windows 8, which Microsoft will no longer support going forward. Windows 8 users will have to upgrade to Windows 8.1 or 10 in order to continue receiving security patches.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments