Issue of Microsoft’s September 2015 Patch Tuesday includes five critical bulletins, two of which tackle remote code execution flaws affecting Microsoft Office. Security experts from tripwire commented on the Microsoft Patch Tuesday.
[su_note note_color=”#ffffcc” text_color=”#00000″]Tyler Reguly, Manager of Security Research at Tripwire :
“The best word to describe this month is probably vanilla. There’s nothing overly fancy or impressive that stands out in the list of updates, it’s the usual flavor that we see month after month without anything exception or unique in the list.
In both 2010 and 2013, Microsoft released 106 security bulletins. This was, to date, the highest number of bulletins released in a single year by Microsoft. With Microsoft releasing bulletin MS15-105 in September, it’d be a pretty safe bet to say that 2015 will be a record setting year for Microsoft Bulletins.”[/su_note]
[su_note note_color=”#ffffcc” text_color=”#00000″]Craig Young, Security Researcher at Tripwire :
“The September ‘Patch Tuesday’ listing is rather tame by comparison to some of the exotic bugs we saw fixed over the summer. The four memory corruption bugs addressed in the second round of patches for Microsoft Edge however did catch my interest.
We have a dramatically lower CVE count in the Edge bulletin compared to the IE bulletin. This is likely a consequence of how proficient researchers have become with fuzzing IE and may change as researchers revamp their toolkits to target Windows 10 and specifically Edge.
Looking at the four Edge vulnerabilities patched in August and the four memory corruption bugs addressed today, it is apparent that Edge and IE are at least sharing some libraries, if not more substantial components of the web rendering engine. This would seem to reinforce the notion that original security research is still being performed first and foremost on the IE browser.”[/su_note][su_box title=”About Tripwire” style=”noise” box_color=”#336588″]
Tripwire is a leading provider of advanced threat, security and compliance solutions that enable enterprises, service providers and government agencies to confidently detect, prevent and respond to cybersecurity threats. Tripwire solutions are based on high-fidelity asset visibility and deep endpoint intelligence combined with business-context and enable security automation through enterprise integration. Tripwire’s portfolio of enterprise-class security solutions includes configuration and policy management, file integrity monitoring, vulnerability management and log intelligence.[/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.