Microsoft is Releasing Out-of-Band Security Updates

Patching your software is one of the most important, yet ignored, tasks in computing. Keeping all of your software up to date with the latest threat definitions can help your business’ IT stay secure. Recently, in a somewhat atypical move, Microsoft has announced that they have released an emergency out-of-band security update to fix two critical security issues. 

The two vulnerabilities were patched off of Microsoft’s typical “patch Tuesday” schedule that sees the software giant release bug fixes every second Tuesday of the month. The fact that they broke their patch schedule suggests that the two vulnerabilities were critical for their customers. Let’s take a look at the two updates and how they’ll function to secure Microsoft products. 

Internet Explorer Zero-Day

The first, and obviously most significant patch, is a zero-day vulnerability found in Internet Explorer, the antiquated (and much maligned) Internet Browser that comes on most Microsoft operating systems. Since this is a zero-day event, the vulnerability had already been exploited in places. 

Little is known about the vulnerability, but Microsoft did call it a remote code execution exploit that if accessed could give a user control over the user account of another. The attack requires phishing an Internet Explorer user onto a malicious website, but once there, an attacker would be able to gain access over the user account of the visitor. 

Luckily, IE currently has an active market share of under two percent, but attacks have already happened so remaining vigilant about the use of IE, and your network’s patch management is key to keeping this particular vulnerability from causing problems for your organization.

Microsoft Defender DOS Bug

The other issue fixed in the out-of-band patch was a denial of service vulnerability in Microsoft Defender. The antivirus program ships with all Windows 10 PCs and is a core component in Windows 10’s sterling security record. 

The bug itself isn’t much of an issue. To successfully exploit it an attacker would need unfettered access to a computer and the ability to execute some code. It disables Windows Defender components and gives people with access (and the ability to code) the chance to completely take over a system with malware or other more sophisticated programs. 

Keeping your software patched and running smoothly is extremely important. Reach out to our expert IT technicians today to see how Horne & Benik can help you manage your system updates and software management at (603) 499-4400.