Microsoft to Warn of Security Flaws
103660
Criticized for a program that only provided some of its largest customers with warnings on security problems in its products, Microsoft Corp. now says it will give all computer users early word on such issues.
635072
Microsoft is to give users three working days notice about upcoming security patches. Starting this month the software giant will provide a general summary of upcoming updates just before it releases patches
660592
(InfoWorld) - After handling 19 sets of patches inÂ JulyÂ andÂ August, system administrators will catch a bit of a break next week when Microsoft Corp. is expected to release just three security updates for its Windows and Office products. On Thursday, Microsoft said that only one of these updates, for Office, is rated as critical. The updates will be released Tuesday in line with Microsoft's monthly patch release schedule. Microsoft'sÂ advance notification on the updatesÂ can be found at its Web site. The other two updates, which fix problems with Windows, are rated no higher than Important, meaning that user action would be required before an attack based on these flaws could succeed. As usual, Microsoft did not release any further details on the patches. That information will be divulged when the patches are made available Tuesday. But the company may be planning to patch aÂ recently reported flaw in its Word 2000 software. Earlier this week Symantec Corp. warned that the flaw was being exploited by attackers to run unauthorized software on a victim's computer. Â
301124
Security tools maker Finjan Software warned on Wednesday that it hadfound as many as 10 security flaws in the last update to Microsoft&#39;s flagship operating system, Windows XP Service Pack 2. In a statement
563601
As anticipated, Microsoft today released five security bulletins rated &quot;important.&quot; All five fix vulnerabilities in Windows that could have been exploited by attackers to
222388
In what may be the first step toward a major security problem, security researchers have released attack code that will crash Windows machines that are susceptible to a recently patched bug in the operating system.The code is not available to the general public. It was released Thursday to security professionals who use Immunity&#39;s Canvas computer security testing software. It causes the Windows system to crash but does not let the attacker run malicious software on the victim&#39;s system.&quot;It reliably crashes Windows machines,&quot; said Dave Aitel, Immunity&#39;s CTO. &quot;In fact, it blue-screened our print server by accident -- this is a broadcast attack, after all.&quot;That&#39;s the biggest concern for security experts who worry that a more dangerous attack may soon follow as researchers dig further into the vulnerability. The bug is particularly troublesome for two reasons. First, it affects a widely used Windows component that is turned on by default. Worse, no user interaction is required to trigger the flaw, meaning that it could be exploited in a self-copying worm attack.Microsoft patched the flaw in its MS08-001 update, released last week, but it takes time for enterprise users to test and install Microsoft&#39;s patches.The flaw lies in the way Windows processes networking traffic that uses IGMP (Internet Group Management Protocol) and the MLD (Multicast Listener Discovery) protocol, which are used to send data to many systems at the same time. The protocols are used by a range of applications, including messaging, Web conferencing, and software distribution products.For a worm attack to work, the attacker would have to send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on the PC. The worm could then spread from computer to computer within a LAN but would generally be stopped from travelling to another network by a firewall.A reliable exploit could be combined with malicious botnet software, giving attackers a way to widen the size of their networks of infected computers. The flaw is rated critical for Windows XP and Vista systems, according to Microsoft.After patching the flaw, Microsoft published some technical research indicating that it would be hard for an attacker to exploit this vulnerability.But Aitel believes that Microsoft may have overestimated how difficult it would be to create reliable attack code. Because it could spread so quickly through a network, a reliable exploit &quot;is going to be worth the effort,&quot; Aitel said. &quot;You can be assured lots of smart people are working on it.&quot;Part of the problem is that IT staff may not be aware of how widely these multicasting protocols are used within their companies, said Russ Cooper, a senior network consultant with Verizon Business. &quot;I am extremely worried that this becomes a problem simply because people are unaware of what they&#39;re already allowing,&quot; he said.If one machine were infected within a network subnet, its attempt to attack other machines might not even be noticeable, he added. &quot;It may look like a large file transfer.&quot;
338253
A flaw in Microsoft&#39;s security server software could allow an attacker to fool business users into thinking that malicious content can be trusted, the software giant warned on Tuesday.
557917
Microsoft Corp. on Tuesday plans to release five security updates targeting flaws in Windows, SharePoint, Visual Studio and Microsoft's instant messaging clients.
113793
In its September security bulletin Microsoft has highlighted a &#39;critical&#39; vulnerability in the processing of JPEG images across a huge swathe of its software products.
718095
Microsoft said it plans to offer tools based on Giant&#39;s technology that will help protect Windows PCs from spyware and other deceptive software.
219303
Microsoft is warning of a new unpatched vulnerability in its Word software.
463255
Microsoft (Quote, Chart) plans to issue a patch for a security flaw in Windows Server software that may allow attackers to gain control over systems running the program, the company said.
625830
(InfoWorld) - MicrosoftÂ released its February set of security updates Tuesday, including critical fixes for bugs in Office and the scanning engine used by the company's security products. The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. The bug has to do with the way that Microsoft's Malware Protection Engine, used by Windows Live One Care and Windows Defender, processes PDF files. Windows Defender is available for free and ships with Microsoft's Vista operating system. "An attacker could exploit the vulnerability by constructing a specially crafted PDF that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. This engine is also used by Microsoft's Antigen and Windows Forefront Security products, meaning that Exchange servers running these products could also be compromised. Although there is not yet any known attack that exploits this flaw, it could become a serious problem for Windows users running Microsoft's security products, according to Amol Sarwate, vulnerability lab manager at Qualys. "These attacks are very difficult to avoid," he said. "These products run automatically in the background." Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday. In total, six of Microsoft's 12 updates are rated as "critical," while the other six have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft WordÂ that fixes six bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office and Internet Explorer.
513312
Microsoft plans to issue two security updates for its Windows operating system products next Tuesday as part of its regular software patch cycle.The updates were pre-announced Thursday morning on Microsoft&#39;s Web site in order to give IT staffers a sense of how busy they will be next week installing the patches.One of the updates is considered critical for Windows Vista and XP users because the flaw it fixes could be used by attackers to install unauthorized software on a victim&#39;s computer. This update is rated important for Windows Server 2003 users and considered moderate for Windows 2000 users.The second update, rated important for all Windows users, could allow an attacker to run software with a higher level of privilege on a system than would normally be allowed.Microsoft did not provide any technical details on the updates.With just two updates scheduled, January will be a light month by Microsoft&#39;s standards. In 2007 the company shipped 69 software updates, an average of just under six per month.
321956
Software giant Microsoft on Tuesday announced 10 security advisories, seven of them critical, urging consumers to patch 21 new flaws in its software products.
554916
Microsoft Corp. offered Wednesday to begin alerting the world's governments early to cyberthreats and security flaws in its attack-prone software.
461708
Microsoft published on Tuesday a patch for a major security flaw in its software&#39;s handling of the JPEG graphics format and urged customers to use a new tool to locate the many applications that are vulnerable.