Microsoft issues five bulletins on Windows flaws
116473
MicrosoftÂ on Tuesday released five Security Bulletins warning of several vulnerabilities that put computers running Windows at risk of attack.
452953
Microsoft has released its last regular security update of the year which includes five new patches, all rated &#39;important&#39;, and the reissue of a &#39;critical&#39; patch after extensive revisions.
751715
As expected, Microsoft has pushed out patches for four vulnerabilities in Windows, Visual Studio and the MSN and Windows Live Messenger software.
422749
(InfoWorld) - Microsoft will release six groups of security patches next week, including three critical updates for Windows and Excel users. The critical updates will fix bugs in many different versions of Microsoft's products, including the latest versions of Excel, Windows XP, Vista, and Windows Server 2003, Microsoft said Thursday in a note on its Web site. Online criminals have used flaws in Excel and other Microsoft Office products in limited attacks over the past year. Typically, the attacker will e-mail the victim a maliciously encoded Office attachment. If the document is opened, the hacker can then gain access to the victim's computer. Microsoft isn't releasing further details on the flaws it's fixing until Tuesday, but it rates an update critical if it fixes a vulnerability that could be used by a hacker to remotely install unauthorized software on a victim's computer. Three other less-critical updates are also planned for next week's "Patch Tuesday" security fixes. They include "important" updates for Microsoft Publisher 2007 and Windows XP Service Pack 2 as well as a fix for Windows Vista. In descending order of severity, Microsoft rates updates as critical, important, moderate, or low.
438457
(InfoWorld) - Microsoft on Tuesday issued six security updates for Windows, Office, and .Net Framework, patching a total of 11 vulnerabilities -- five of them rated critical. The most serious of the batch is MS07-039, said security analysts who, unlike lastÂ  month, had no trouble naming that critical update as the one which should beÂ  patched first. "By far, this is the top of the list this month," said Andrew Storms, director of security operations at nCircle Network Security Inc. MS07-039 patches a pair of bugs in Active Directory in Windows 2000 Server and Windows Server 2003, the two supported server editions of Microsoft's operating system. The most dangerous of the two is a vulnerability in the way Active Directory validates an LDAP (Lightweight Directory Access Protocol) request.Â  According to Microsoft's write-up, "an attacker who successfully exploited this vulnerability could take complete control of an affected system." "Definitely at the top of today's list," agreed David Dewey, a researcher with IBM Internet Security Systems' X-Force team. "It's definitely exploitable." Dewey should know, since it was a colleague at ISS, Neel Mehta, who discovered the flaw last summer. "Neel's created proof-of-concept code in-house during the time we worked on this with Microsoft," said Dewey. "It would certainly be worth the effort" to exploit this, added Storms. "Active Directory is in the center of every Windows network. There's a lot in there, including the group policy objects that set security -- and everything about every user." Unlike most vulnerabilities, the Active Directory bug can be exploited without any user interaction, and on Windows 2000 Server, the older of the two operating systems, it can be attacked by an anonymous user. Although Windows Server 2003 may look safer at first glance -- an attacker must have valid credentials to exploit the bug on that edition -- looks can be deceiving, said Tom Cross, another X-Force researcher. "In this case, the authentication requirements become less important," said Cross. "Anyone on the network -- an employee, for example -- would by definition have credentials." Worse, said Cross, is that outside attackers could exploit this without a lot of trouble by bundling an MS07-039 exploit with a multi-strike attack that figures on compromising some fraction of enterprise laptops while they're outside the network. Once back inside the enterprise's perimeter, the Active Directory exploit could fire up -- using the credentials of the hijacked notebook -- to grab systems running the supposedly more secure Windows Server 2003. Two of the remaining five bulletins were pegged "critical" by Microsoft, while another two were marked "important." The final update was tagged as "moderate." MS07-036, which patches three vulnerabilities, two of them judged critical and oneÂ  of them a zero-day flaw already out in public, repairs bugs in Excel 2000, 2002, 2003 and 2007. Similar vulnerabilities in other Microsoft Office document formats, including those in Word and PowerPoint, have been used by attackers to slip malicious code into corporations. Some of these attacks have been so narrowly targeted that they're launched against just one user at one company. What's interesting about this update, said a Symantec researcher in an e-mail, is that Microsoft got it wrong back in February when it downplayed the initial report of the Excel threat. Then, Symantec's DeepSight threat network analysts reported Excel 2003 was susceptible to a denial-of-service bug which, if exploited, could crash the program. Four months ago, Microsoft denied that the bugs were actually vulnerabilities. "Microsoft has completed its investigation of new public reports of possibleÂ  vulnerabilities in Microsoft Office 2003 and Microsoft Excel 2003 [and] hasÂ  confirmed that these are not product vulnerabilities," a spokeswoman toldÂ  Computerworld at the time. "They are issues that can cause the application to become unresponsive. Users can restart the application," she said. "[Today's] bulletin includes a fix for a previously disclosed denial-of-service issue from February 2007 which is now billed as having the potential for remote code execution," noted Oliver Friedrichs, director of Symantec's security response group. As Friedrichs pointed out, Microsoft characterized all three bugs patched by MS07-036 as having a "remote code execution" impact, meaning that hackers couldÂ  inject their own malware into a PC after exploiting the Excel flaws. The third critical update, MS07-040, plugs three holes in the .Net Framework, the primary Windows runtime environment called on by developers. Notably, all three vulnerabilities were previewed during a sneak peek at the Syscan'07 security conference last week in Singapore. But the patches may be a ton of trouble to corporate IT managers, said Storms, because the .Net Framework is so widely used by corporate developers of in-house software. "Not only will [companies] have to run QA on the patches, they'll have to run QA on the code that runs on .Net," said Storms. The fixes in MS07-040 apply to all but Version 3.x of .Net Framework, adding additional complexity to in-enterprise application testing. Of the remaining security updates, one fixes a flaw in Publisher 2007, another patches Internet Information Services 5.1 on Windows XP Professional SP2, and the thirdÂ  quashes a bug in Windows Vista's bundled firewall. That last, although rated "moderate," second-from-the-bottom in Microsoft's four-step severity rating system, is worth some reflection, said Symantec's Friedrichs. "Microsoft's decision to rewrite the Windows network stack and its accompanying firewall [for Vista] continues to have long-term security implications," Friedrichs said. "A network stack can take decades of heavy scrutiny in order to become battle hardened. As an operating system's first line of defense, its quality is directly related to its ability to withstand attack." On its own, added Friedrichs, the firewall bug isn't a big deal; the result of an exploit is that the attacker can "see" the system when it should actually be completely invisible to outside probes. "[But] if this logic flaw were combined with a vulnerability in one of the exposed services, this could have more serious, widespread implications." As usual, Microsoft's monthly updates have been posted to Microsoft Update and Windows Update services, and they can also be retrieved through Windows Server Update Services (WSUS).
735918
Microsoft Corp. published six security fixes &#151; half of them rated "critical" &#151; in its regularly scheduled software update Tuesday.
550558
Microsoft plans to release six security updates on Tuesday to patch issues in Windows, Office and the .Net Framework, with three of the updates listed as "critical."
577900
As part of its Patch Tuesday updates this week, Microsoft corrected 10 vulnerabilities in Windows and Office, 7 of which were deemed "critical." Three critical flaws were fixed in Excel that could allow for remote code execution, while one was fixed in Windows 2000 and Server 2003.
172483
Microsoft issued 11 security bulletins on Patch Tuesday covering a total of 17 vulnerabilities, 10 of them critical. The 11 patches address the Windows operating system, the Internet Explorer Web browser, Microsoft Office and other programs.
98399
Microsoft yesterday released 10 new security bulletins to fix multiple components in its Windows operating system and applications.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
716944
A trio of new and unpatched vulnerabilities in Microsoft Windows were made public on security mailing lists over the weekend, nudging some security vendors to alert users that their systems may be open to attack and hijacking.
484861
On October 10, Microsoft will issue 11 security bulletins as part of this month's Patch Tuesday. Six of the updates affect Windows, with the highest severity being "critical." Another four patches will cover Microsoft Office, also with critical severity, while a moderate fix is slated for the .NET Framework.
388719
(InfoWorld) - Microsoft Corp. plans to patch its Windows and Visual Studio products next week, but it does not have a fix in the works for aÂ widely publicized flaw in Word, which hackers are reportedly exploiting in targeted attacks. The company's security team is readying five sets of patches for Windows, and will also issue a single critical security update for Visual Studio, Microsoft said in an alert published Thursday. Microsoft rates the most serious of its Windows updates as "critical," meaning an attacker could exploit the underlying flaw to run malware on a victim's PC with no user action, the company said. These security patches are usually released on the second Tuesday of each month, and the company strives to publish a small number of updates in December, because IT operations are often short-staffed during the holiday season. On Tuesday, Microsoft warned of a vulnerability in its Word software that had been reportedly used in online attacks. Security researchers rated this flaw critical, because an attacker could exploit it to run malicious software on a victim's PC. For such an attack to work, however, the victim would first have to be tricked into opening a maliciously encoded Word file. The Word flaw is not scheduled to be patched next Tuesday, said a spokesman for Microsoft's public relations firm. There is, however, one critical Visual Studio flaw that may be addressed in the updates. That bug is in Visual Studio 2005's WMI Object Broker ActiveX object. It was first reported in late October.
715528
Microsoft on Tuesday issued 10 security advisories - seven of them critical - urging consumers and businesses to patch 21 new flaws in Windows software products.
391512
Slew of Patch Tuesday security updates will include "critical" fixes for Windows, Office and Microsoft's security tools.
372618
Microsoft plans to release a dozen security updates next week to patch critical vulnerabilities in Windows, Office, Visual Studio and in its anti-virus software.