Microsoft Patch Tuesday brings critical Explorer, Outlook fixes

Microsoft has shipped fixes for critical vulnerabilities in Internet Explorer and Outlook as part of September's round of vulnerability fixes.

Overall this month, Microsoft issued 13 bulletins -- 4 for them critical -- that cover 47 vulnerabilities found across Internet Explorer, Outlook, SharePoint, Office and the Windows kernel. It is an exceptionally large number of patches for any one month, said Wolfgang Kandek, CTO of IT security firm Qualys.

[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in "Fight Today's Malware," InfoWorld's Shop Talk video. | Keep up with key security issues with InfoWorld's Security Adviser blog and Security Central newsletter. ]

Of this round of patches, enterprise security professionals should take a look first at MS13-068, which details a vulnerability allowing for remote code execution in Microsoft Outlook, Kandek said.

This remote code execution vulnerability is particularly dangerous because it does not require user interaction to launch.

The flaw lies in how Outlook handles incoming user certificates, which identify the sender of an email. Outlook's certificate parser can recognize only 256 certificates in any one email.

"The programmer [probably] said 'Well, no one would nest more than 256 certificates,' and no one in their right mind would," Kandek said. "But an attacker would. They always go after this sort of thing."

A hacker could nest more than 256 certificates in an email, which would cause a buffer overflow that could place malicious data in the computer's memory. Microsoft failed to add a mechanism that would check to ensure no more than 256 certificates have been submitted to the parser by any single email.

An exploit for this vulnerability would not require the user to click on anything. Code could automatically be triggered simply by displaying the contents of the email message in a preview window.

MS13-069 for Internet Explorer, a collection of 10 patches, should be dealt with as soon as possible as well, Kandek advised. With these vulnerabilities, an attacker could plant malicious code on a Web page that, when visited by an unpatched browser, could take control of the user's machine, said Amol Sarwate, director of Qualys' Vulnerability Labs .

While Microsoft rated bulletins for Microsoft Office Word, MS13-072, and Excel, MS13-073, as important -- rather than critical -- they still could be harmful to the enterprise if not applied, Kandek said.

Both of these bulletins focus on file format vulnerabilities. They require a user to open a file in order to initiate code that would take control of the computer. Kandek pointed out that environments with sensitive data could be subject to spear-fishing attacks that use these vulnerabilities, in which an attacker may devise a way to fool the user into opening a malicious file.

In addition to the Microsoft patches, administrators should also take a look at the critical patches that Adobe also issued Tuesday for Reader and Flash. Users of Google Chrome and Internet Explorer will have the Flash patches applied automatically, Kandek said.

Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com

View the original article here

Google brings more real-time traffic reports to Maps, courtesy of Waze

IDG News Service - Google is making good on its promise to make its Maps app more comprehensive and useful following its acquisition of mapping company Waze, with some new traffic update features going live Tuesday.

Users of the Maps app on Android- and iOS-based devices will have access to real-time incident reports from Waze users, Google Maps vice president Brian McClendon said in a Tuesday blog post. That means that when people report accidents, construction, road closures and more on Waze, those updates will also appear within the Google Maps app in Argentina, Brazil, Chile, Colombia, Ecuador, France, Germany, Mexico, Panama, Peru, Switzerland, the U.K. and the U.S., Google said.

The integration between the two products is significant, said John Jackson, an industry analyst with IDC. While the new features for Google Maps probably will not attract new users in droves, they represent Google's attempts to add richness to its mapping products and provide more context to users, he said.

Google announced its acquisition of the crowdsourced mapping app developer Waze in June, for a reported price of more than $1 billion.

Waze's mobile app, which is still operated by Google, is designed to provide "smarter" real-time navigation by letting its users share road reports on accidents, police checkpoints and other obstacles they encounter while driving.

At the time of the deal, Google framed the acquisition as a way for the Internet company to make its own maps products more comprehensive, useful and accurate. Waze claims to have roughly 30 million users, working toward a common goal of "outsmarting traffic."

Google last updated the navigation features on its Maps app last month, showing users reports of problems on the road. That information, however, came from other data providers such as TomTom and not Waze. Tuesday's changes constitute a wider set of real-time traffic reporting features for the Google Maps app.

The Waze and Google Maps teams "are working together to harness the power of Google technology and the passion of the Waze community to make it easier to navigate your daily life," said Google's McClendon.

The Waze app is also getting two new features of its own. First, the Android and iOS versions of the app have been updated to include Google Search, to make it easier for people to find businesses and local addresses. Second, the service's Map Editor tool now includes Google Maps Street View and satellite imagery to make it easier to correct map errors reported by the community, Waze CEO Noam Bardin said Tuesday in a company blog post.

Since the acquisition Waze's developers have been working to identify Google services that can improve the app for both its users and the editors who update its maps, the company said.

More integrations between Google Maps and Waze are on the way, Google's McClendon said, though he declined to name specific features Google's current plan is to continue to operate Google Maps and Waze as separate apps, a Google spokeswoman said.

Besides making its mapping products more comprehensive from a navigation perspective, Google also faces mounting pressure to monetize products on mobile as more people migrate away from desktop PCs in favor of mobile devices. To boost Maps' revenue, earlier this month Google announced some additional advertising features for the app. For instance, some ads for local businesses will now appear at the bottom of the screen after a user performs a search.

A Google spokeswoman said the company had nothing else to announce regarding future advertising plans for either the Maps app or Waze.

The U.S. Federal Trade Commission, meanwhile, launched a probe in June into possible antitrust issues stemming from Google's acquisition of Waze. The FTC is looking into the issue of whether Google, a dominant player in online mapping, swallowed one of its most viable competitors.

It is unclear how Tuesday's integration could impact that investigation. But there may not be space right now for another large-scale competitor, said IDC's Jackson. The only other strong player may be Nokia, which could provide some competition through its Here business unit for mapping and location services, he said. Tuesday's integration is not good news for companies like Apple and Facebook, he said.

"We continue to work with the FTC to answer their questions," the Google spokeswoman said.

The FTC declined to comment on the investigation.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com

Reprinted with permission from IDG.net. Story copyright 2012 International Data Group. All rights reserved.

View the original article here