Patch Tuesday is the unofficial term
used to refer to when Microsoft
regularly releases security patches for its software products.
It occurs on the second,
and sometimes fourth Tuesday of each month in North America.
If you go to this site here, this is Microsoft’s security bulletin,
you can get to at this address here.
You can see the latest security patches.
One patch can fix many vulnerabilities.
You want to install all the critical patches, definitely,
and really, you want to install the important ones too,
but you can make that decision
based on what you think of these security patches.
The KB number will match
the number shown in the Windows operating system
for the details and the KBs as you need to patch.
CVE numbers are unique to the vulnerability or the bug.
You can see these if you click on the patch.
We can see here, CVE number here.
We’ll click on this.
That will take us through to the common vulnerabilities and exposures,
and provide us more information on that.
You can also choose to Google for
the vulnerability and fine
other juicy information about it.
You can see here that this one
was found, that's one of the hacking teams' bugs
they were using to hack machines.
And you can search to see whether there's exploits available for it
and if it's relatively new,
and maybe not.
You can check on CVE Details,
the vulnerability.
And here we can see this is a particularly bad one,
9.3:
"allows remote attackers to execute arbitrary code”.
Yeah. That definitely needs to be patched.
Those are arbitrary code that are running remotely
and buffer overflows are particularly bad.
Anything that is rated critical will be rated for good reason
and definitely should be applied.
And anything that’s important should be important to apply.
You can see the CVSS score here,
9.3 and that's
something the industry’s trying to adopt
in order to have a universal standard for
how dangerous something is,
and it can help you make a decision
as to whether or not you want to apply it or not
But if it's red, apply it.
Details for vulnerabilities for all types of software and
operating systems can be found on a few places.
This Common Vulnerabilities and Exposures is a good place.
The National Vulnerability Database
and CVE Details itself.