Patch-a-Palooza: More Than 560 Flaws Fixed in a Single Day

Information technology groups have their work cut out for them this month. 

On April 14, six makers of popular enterprise software — Microsoft, Oracle, SAP, Intel, Adobe, and VMware — issued patches for at least 567 software vulnerabilities. Oracle's Critical Patch Update for the month, which rolls up fixes into a single massive patch for each product, accounted for more than 70% of the patch load, addressing 405 new security vulnerabilities, according to the company. An analysis of Microsoft's April security bulletin found that the company closed 113 security vulnerabilities, while SAP, Intel, Adobe, and VMware accounted for another 49 issues.

Overall, the crowding of software fixes has turned the second Tuesday of the month — a day on which Microsoft has traditionally released patches for many years — into a deluge of work for IT groups, says Jake Kouns, CEO and co-founder of Risk Based Security, a vulnerability information and management firm.

"Patch Tuesday is all about making software updates more organized so that companies can assign resources because they know when [the patches] come out," he says. "With more and more companies piggybacking on that, it becomes a challenge. How many patches can you handle in one day?"

The massive patch load comes as companies continue to adjust to the vast majority of their employees working from home, a fact that means patching could cause significant headaches, especially if companies have not prepared a capability to efficiently push patches to workers' machines. 

"Given the shift to remote work for many organizations in combination with the current patch load from Oracle's update earlier this week and what looks like a backlog of patching, this looks like a busy month for many security teams," says Jonathan Cran, head of research at vulnerability management firm Kenna Security.

Oracle issued Critical Patch Updates (CPUs) for 26 different products, including issuing fixes for 74 vulnerabilities in its E-Business Suite and 56 vulnerabilities in its Fusion Middleware.  

Microsoft closed 113 security holes in Windows, Microsoft Office, the Internet Explorer and Edge browsers, and other apps and tools. Nineteen of the vulnerabilities were rated Critical, 96 Important, five Moderate, and two Low, with nine issues rated differently, depending on the platform. One flaw, CVE 2020-0796, is a remote code execution vulnerability and is currently being used in active attacks, according to Kenna Security.

SAP patched 33 flaws, five of which were given a Common Vulnerability Scoring System rating of 9 or higher. Finally, Intel closed 9 issues in different firmware and software components, Adobe shuttered five security weaknesses, and VMware fixed two issues.

For companies that have moved to remote patch management, the workload should be manageable. Yet many companies were taken by surprise by the need to move employees to remote working, and the sheer number of fixes that need to be deployed this month could cause problems, says AJ Singh, co-founder and vice president of product at NinjaRMM, a remote monitoring and management service. 

"It is definitely a bigger hassle," he says. "And if there is a bad patch that causes issues, companies may have to put boots on the ground to actually fix the devices."

Even without the need to work during a pandemic, the move of many companies to release patches on the same day as Microsoft's original Patch Tuesday may be hurting customers more than helping them. 

Overall, the number of vulnerabilities released annually has more than doubled in the past three years. While that has largely been driven by the fact that more vulnerability reports are issued for a wider variety of products, the number of vulnerabilities released on peak days has also increased, according to Risk Based Security, which calls this perfect storm a Fujiwhara Event.

"I think it does make it more difficult," says Risk Based Security's Kouns. "Most companies — those that are dealing with remote patching before — won't have a problem. But for companies who when you ask, 'why did you adopt cloud?' and they answer, 'because of COVID' — they are going to have problems."

Related Content

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.