Patch Tuesday comes early this month, since January started on a Tuesday. There are seven bulletins, addressing twelve issues in Windows, admin software and developer tools.
January 2013 bulletins
Adobe is planning to release security updates for its PDF reader and authoring software on January 8, 2013. Security advisory APSB13-02 has all the details.
2013’s first Patch Tuesday arrives at 10am on January 8. This month will see seven bulletins, addressing a total of twelve vulnerabilities in Windows, Office, Microsoft developer tools and server software. Two of the bulletins are rated Critical. You can find all the details in the advance notification bulletin.
The Flash vulnerability reported on December 11 has finally been fixed in Internet Explorer 10.
Microsoft chose not to use the regular Flash plugin in Internet Explorer 10, deciding instead to integrate the player into the IE10 code. As a result, any time the Flash player is updated, Microsoft must make corresponding changes to IE10. Hence the delay in producing the patch for IE10. Google now does the same thing with their Chrome browser, but they tend to make the required changes much more quickly.
Ars Technica has a useful post showing how to remove the useless software (crapware) that comes pre-installed on Windows 8 computers. The specific software of course varies between PC manufacturers, but the general idea is the same in all cases: most, if not all, of the software added by PC builders can be safely removed.
The approach used in this article is to reinstall Windows 8 from scratch, which is certainly an effective way to get rid of crapware. However, simply disabling and uninstalling said crapware is usually sufficient.
Microsoft has issued a special “Fix It” patch for the recently-discovered vulnerabilities in older versions of Internet Explorer.
The original security advisory has been updated to include a link to the fix.
Anyone still using Internet Explorer 6, 7 or 8 should install the fix or stop using IE immediately.
Update 2013-Jan-05: According to the Internet Storm Center, the temporary workaround provided by this Fix-It from Microsoft has already been rendered ineffective by means of a bypass.
A new exploit, targeted at users of older versions of Internet Explorer, recently surfaced. IE 9 and 10 are not vulnerable to this exploit.
Microsoft is working on a patch, but until it’s available, anyone using Internet Explorer 6, 7 or 8 should exercise extreme caution when browsing the web, or – better yet – switch to a different browser such as Firefox, Opera or Chrome.
Unfortunately for anyone still using Windows XP, including a large number of corporate users, recent versions of IE (9 and 10) don’t run on that version of Windows. XP users are strongly encouraged to stop using Internet Explorer.
Details:
Brian Boyko’s 20+ minute animated video is an entertaining – albeit painful – look at the new Microsoft operating system. Spoiler: he hated it. Boyko originally intended to spend several days working with Windows 8, and produce his review on a Windows 8 computer, but he gave up in frustration and made this video instead. The video is worth watching; although some of what he says is admittedly personal opinion, he delves into the science of user interfaces and explains why in some respects, Windows 8 is worse than DOS.
A new version of Opera was made available today. Version 12.12 fixes a few security issues and other minor bugs.
This month’s Ouch! newsletter (PDF) from SANS lists the steps necessary for users to secure their computers. If you’re doing everything on this list, pat yourself on the back. If not, it’s time to take action.
boot13