erroneo.us
Search all guides⌘K

Digest · Saturday

Security digest: December 29, 2012

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Most can relax: IE CVE-2012-4792: 2012 Watering-Hole Zero-Day in KEV. Anyone still running Windows XP, Server 2003, Vista, Server 2008, or Windows 7 or Server 2008 R2 with IE 8, such as old kiosks, lab PCs or plant-floor workstations.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2012-4792

IE CVE-2012-4792: 2012 Watering-Hole Zero-Day in KEV

This bug only affects IE 6, 7 and 8 and was patched in January 2013; the only real exposure is a forgotten legacy Windows machine, which should be isolated and replaced rather than patched bug by bug.

Must act: Anyone still running Windows XP, Server 2003, Vista, Server 2008, or Windows 7 or Server 2008 R2 with IE 8, such as old kiosks, lab PCs or plant-floor workstations.

Can relax: Everyone on supported Windows with Microsoft Edge, Edge's IE mode, or IE 9 and later; MS13-008 says IE 9 and IE 10 were not affected.

  1. Search your inventory for Windows XP, Server 2003, Vista and Server 2008 hosts, and for Windows 7 or Server 2008 R2 machines still on IE 8.
  2. Replace or upgrade those systems; if one must stay, confirm MS13-008 (KB2799329) or a later IE cumulative update is installed.
  3. Do not rely on workarounds such as the 2012 Fix it shim, which Exodus Intelligence bypassed within a day.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.