Happy Halloween! Security bugs under attack squashed, more flaws fixed
Oh no, you're thinking, yet another cookie pop-up. Well, sorry, it's the law. We measure how many people read us, and ensure you see relevant ads, by storing cookies on your device. If you're cool with that, hit “Accept all Cookies”. For more info and to customize your settings, hit “Customize Settings”.Here's an overview of our use of cookies, similar technologies and how to manage them.
Of the new October patches, 13 address critical-rated bugs. This includes 12 that lead to remote code execution plus Rapid Reset DDoS attacks. The rest are deemed"important" security flaws.– earned a 9.8 out of 10 CVSS severity score. The issue could allow RCE, and it doesn't require user interaction to exploit.
"Microsoft doesn't rate this as critical since it would require a brute-force attack, but these days, brute force attacks can be easily automated," Childs argued, adding that IIS users should treat it as critical and patch ASAP.is also an"important" bug that should be treated as critical if your organization runs Exchange Server in-house. This one is a Microsoft Exchange Server RCE that earned an 8.
For example:"With the ability to gain access to read every email that has been sent and received, or even to impersonate any given user, this could be advantageous for financially motivated criminals where business email compromise attacks are no longer from spoofed accounts, but from the legitimate email holder," Breen warned.joined in the October patch party with a critical 9.4-rated flaw in its NetScaler ADC and NetScaler Gateway appliances.