Every month brings both new challenges and new opportunities to the world of technology. Problems arise, and updates bring stronger security to our systems.
The month of June has been no exception, and includes the usual patches for Windows operating system. However, there are also several unusual patch releases for browsers and CPUs.
Some flaws may be difficult to exploit, but that doesn’t mean you can ignore them forever.
Many organizations enjoy the peace of mind that outside services provide, including patching and updating for Windows machines. However, not all updates may be covered by a standard agreement or an internal patching process.
Because of this, it’s important to know exactly what’s covered and what isn’t.
Here are the recent patches you’ll need to take note of.
Microsoft Windows Patches and Updates
Microsoft’s June updates address 49 vulnerabilities, a decrease in volume. However, this is offset by the fact that attackers already exploit six zero-day vulnerabilities.
The active exploitation takes advantage of remote code execution, privilege elevation, and information disclosure bugs.
Because of this, businesses need to move quickly through patching protocols.
Additionally, five of the critical bugs are shared by both the Windows 10 OS and Windows Server versions 2008 through 2019.
The cumulative updates also include security fixes for the May 2021 patch, as well as the 2020 updates for May and October. These improve security features for SharePoint, input devices (mouse, keyboard, etc.), and Windows Authentication.
Adobe Vulnerabilities
Adobe issued an unusually high 41 patches for their products, including Adobe Photoshop, Adobe Acrobat and Reader, and Adobe After Effects.
Using specially crafted PDFs, attackers can gain arbitrary code execution on a victim’s computer. There are no known workarounds, meaning patching is the only known protection.
These problems for Adobe Acrobat and Adobe Reader are already known to be actively exploited. Coupled with how common the software is, these issues should be treated as a priority.
Marketing departments often use less widespread Adobe products on Apple computers, which often require different patching processes than Windows devices.
This would be a great opportunity to verify if your MacOS users have been keeping their OS and software packages fully updated.
Intel Patches
Also in June, Intel released 29 security advisories to address 73 vulnerabilities in BIOS firmware, Bluetooth products and more.
Although these bugs aren’t actively or easily exploited, nearly 20 of the vulnerabilities rate as “High” since they permit escalation of privilege.
Firmware updates can be much harder to test, so they often slip down the list of priorities when compared with the typical patches.
Although these flaws aren’t easy to take advantage of, their severity means you’ll need to address them sooner rather than later.
Chrome and Samsung Mobile Fixes
PuzzleMaker attacks combine Chrome and Windows vulnerabilities to create malware deployed with system privileges, as discovered by Kaspersky researchers. Thankfully, June patches for Windows and the latest updates for Chrome should eliminate this threat.
This marks the 6th zero-day Chrome vulnerability exploited in the wild to be fixed this year. Google Chrome should automatically attempt to update to version 91.0.4472.101, but managers need to spot check users, making sure the upgrade has been applied.
In addition to these, Samsung issued patches to fix vulnerabilities on pre-installed apps that allow stolen SMS messages, spying on users, or elevated privileges on Samsung Mobile devices.
As with Chrome, Samsung devices should automatically update, but IT administrators need to verify that users’ devices are corrected before connecting to the network.
Patching Cautions and Assistance
Just because new patches correct known issues, doesn’t mean they won’t create new ones of their own. Incompatibilities can arise, and because of this, it’s crucial to make sure each system is properly backed up.
Hardware firmware is more difficult to roll back, so you’ll want to test these updates on a handful of sample devices before continuing to the rest of the organization.
You don’t have to worry as much about the side effects of upgrading software such as Adobe or Chrome, but they might require special attention since they lay outside of normal patching processes.
When patching actively exploited vulnerabilities that permit privilege escalation, never assume that the patches were in time to prevent future attacks.
Continue monitoring your networks and systems for signs an attacker entered your network before it was corrected.
Ideal Integrations provides outsourcing to relieve an IT team of the monthly patching burden or cybersecurity monitoring, so they can focus on tasks that deliver more value to your organization.
Call Ideal Integrations at 412-349-6680 or fill out the form below and we can discuss what services may help your IT team.