May Patch Tuesday coming up - Microsoft still not sure if latest 0-day fix will make the cut

[ShyWriter]

.

May Patch Tuesday coming up - Microsoft still not sure if latest 0-day fix will make the cut

by Paul Ducklin on May 11, 2013

Microsoft's Patch Tuesday for May 2013 will be published in the coming week.

It'll be out on Tuesday 14 May 2013. (Wednesday 14 May for everywhere from about Malaysia eastwards.)

Here's the elevator pitch:

• 33 vulnerabilities identified and fixed.
  
• Ten separate patches.
  
• Eight rated Important. (Apply ASAP.)
  
• Two rated Critical. (Apply immediately.)
  
• A reboot is required.
  

Loosely translated, Microsoft's interpretation of important means that an exploit against the vulnerability is likely to be found, but you'll probably get some sort of warning, such as a pop-up dialog, if an attacker tries to use it.

On the other hand, critical means not just that a exploit is likely (or already known), but that it can be used silently - what's known as a drive-by install - without popups or any other kind of warning.

The burning question about the May 2013 Patch Tuesday is this: will it fix CVE-​​2013-​​1347? (More...)

Article continued at: http://nakedsecurity.sophos.com/2013/05/11/may-patch-tuesday-coming-up-microsoft-still-not-sure-if-latest-0-day-fix-will-make-the-cut/

Steve