Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Beginning Of The End For Patch Tuesday
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
5/9/2015 | 7:32:46 AM
an old idea that doesn't work
updates only; no version changes?   it's an old idea that doesn't work.  
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/8/2015 | 8:42:32 PM
Re: Windows 10
Until Microsoft evolves and can match behavior like kpatch and kGraft in the 4.0 Linux kernel then the reboots are a sad necessity for orgs and users that either choose to or have to use Windows systems.  I do my part in encouraging my users and the Enterprise to switch to GNU/Linux where strategically meaningful.
theb0x
50%
50%
theb0x,
User Rank: Ninja
5/8/2015 | 4:35:02 PM
Windows 10
"Together with making Windows 10 widely and freely available," says Kandek, "this is an excellent move by Microsoft to increase security on the Internet."

 

I look forward to my free copy of Windows 10.

 

I also look forward to multiple manditory system reboots required each day whenever a critical patch is deployed.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/8/2015 | 4:08:50 PM
Re: It's About Time
Yes, for the Enterprise I would definitely hope nobody is automatically patching a Production system :-)

If you look at the SANS recommendations below (oldie but goodie), at first they look daunting, but you have to remember that you determine the length of each phase: 

 
  • Phase 1 – Baseline and Harden
  • Phase 2 – Develop a Test Environment
  • Phase 3 – Develop Backout Plan
  • Phase 4 – Patch Evaluation and Collection
  • Phase 5 – Configuration management
  • Phase 6 – Patch Rollout
  • Phase 7 – Maintenance Phase – Procedures and Policies

Within this lifecycle, you will quickly see if for your organization the early-release from Microsoft is of benefit or if your policies ultimately render that as a "may as well not exist" feature.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/8/2015 | 3:17:22 PM
Re: It's About Time
To add onto this I would recommend that Automatically Patching, if there is an option, be turned off in Windows 10. Knowing windows I would have to believe they will have an automatic patch function that may.

I am also going to play devils advocate here and say that although its beneficial available patches will be released earlier, is there a downside to a non-stringent patch process? I would posit that apps that have any types of Windows depencies could potentially be rendered unusable as patching looks to close vulnerabilities not focus on functionalities. My overall point is that although its great that patches will be out earlier that they should still be managed. Apply to test machines, have test period to ensure critical applications aren't affected, then push to production.

Security benefit yes but potential functionality issues.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/7/2015 | 8:41:07 PM
It's About Time
This is a good thing for those who plan to patch as soon as the update is made available. The sooner exploitable holes are closed (for updates that correct vulnerabilities) the better. In fact, plan on it. Don't wait and suffer the potential risk a regular vendor-scheduled update can pose.

Also, this will be all the better because the whole idea of a "patch Tuesday" advertises the "when" in contrast to the update's release date. The last thing you want is to have a time block advertised that your system is not patched to the latest code fix for any given system flaw.

So, now we know what Windows 10 is doing right... What is it doing wrong?


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...