What’s New
- DC770 – A quick reminder that DC770 meets the first Tuesday of each month at 7:00pm EDT in the basement at Jefferson’s.
Updates
Executive Summary – This month’s Microsoft updates looked oddly familiar to last month, with the descriptions of many of the issues patched sounding eerily similar to last month, which as you may remember was a particularly “exploitable” month of updates. As always, it is extremely important for all available updates to be installed as soon as possible. Adobe is back on the
Microsoft – Microsoft released 14 bulletins this month (MS16-104 through MS16-117). Seven of the 14 are rated critical and the remaining are rated important (by Microsoft). It should come as no surprise that updates for Internet Explorer and Edge are leading the pack (again) with patches for several bugs in Internet Explorer and Edge which, as Johannes B. Ullrich noted at SANS, “Kind of makes you wonder how much Edge differs from Internet Explorer“, a thought that we’ve mentioned with the last couple of updates. Similar to previous months, many of the CVE’s patched this month have an exploitability rating of 1 (Exploitation More Likely) but no known exploits are listed on SANS at this time. All users are encouraged to install this month’s Microsoft Updates at their earliest convenience.
Microsoft releases regular updates the second Tuesday of each month, often referred to as ‘Patch Tuesday’. These updates are catagorized as Low, Moderate, Important or Critical. Details on the categories are available here. The updates can include any supported Microsoft product from Windows to Office to Internet Explorer and server products like Exchange and SQL Server. If you have one or more of these products installed, especially if the update is listed as Important or Critial, it’s important that the updates are installed.
Additional details are available Microsoft Here and Here (SANS) .
Adobe – Adobe this month has released several updates to Flash Player, Air, and number of their other products. Many of these updates are listed as critical, so it is important to visit the Adobe Website and get the latest version of any Adobe products you may use.
Like Microsoft, Adobe now releases updates to their products on the second Tuesday of each month. Adobe will also release ‘out of band’ updates if necessary to address critical vulnerabilities in their products. Adobe products include Adobe Reader (for viewing PDF files), Adobe Flash Player (often used to watch videos, for interactive content like games, etc.), Adobe Shockwave and the Adobe Creative Suite (Photoshop, Illustrator, Acrobat, Lightroom, etc.).
Additional details are available from Adobe Here including links to download the update(s) and instructions for installation. Additional information is available here (Threatpost).
Java – The latest version of Java is 8 update 101. If you’ve got older versions, especially versions that start with 6 or 7, remove them. Also, we’re still seeing that the installation of newer versions of Java don’t remove the older (often vulnerable) versions so, while you’re installing the latest update, check for older versions that may still be there.
Java is a tool that’s widely used by banks, online service providers and even security companies for SSL VPN connections. Java’s ‘official’ release cycle is approximately quarterly but Java updates have been ‘fast and furious’ in recent months. It’s worth noting again that, if you don’t absolutely need Java on your computer, it’s not a bad idea to remove it altogether.
Additional details are available from Oracle here.
Security News, Sponsored by Piratica -The Piratica Team is away at DerbyCon v6.0! and so this month’s security update will be a little light but always be sure to check Piratica.us to keep up with the latest in security news and get a real world take on how the latest breaches and hacks effect you and your business. Word on the web is that Yahoo is about to confirm a massive data breach impacting 100 million + users, ICANN will change the Root Zone Signing Key pair for the first time in history in the coming year (increasing the key size from 1024 to 2048 bits for increased security), and a new malware RAUM is targeting the casual BitTorrent users by infecting popular public torrent sites. More information on these stories can be found here, here, and here (respectively). Stay tuned for next month as the Piratica team returns from their “con tour” and shares some new found knowledge learned.
Piratica is a risk management firm and we work with client organizations to help them identify and understand the risks to their organizations from cyber criminals.. We believe that the first step in any solution is to correctly and completely identify the problem. Additional information is available on our website, Facebook and Twitter.
These updates will be automatically reviewed, approved and installed for MyIT Customers. If you would like more information about the Cyber Tech Cafe MyIT services for your business, please let us know. The Cyber Tech Cafe MyIT services are availalbe in three different levels (Bronze, Silver and Gold) and can provide updates only (Bronze), updates and proactive network auditing and monitoring (Silver) or updates, proactive auditing and monitoring and up to 10 hours of priority support at a significantly discounted rate (Gold). Pricing is based on the number of physical locations, servers and workstations that you have.