Microsoft fixes four flaws in four patches; one is critical
40932
Patches address flaws in Microsoft Agent in Windows 2000, Windows Services for UNIX, Visual Studio, MSN Messenger and Windows Live Messenger.
691908
(InfoWorld) - Microsoft has released its security patches for September, fixing known vulnerabilities in its MSN Messenger software and Unix services for Windows as well as a critical bug in Windows 2000. In total, Microsoft patched four bugs in its products. This was one less update than expected following the software maker's last-minute decision to scrap a fix for its SharePoint collaboration software. The Windows 2000 update is the only one Microsoft rates as critical. It affects the Microsoft Agent software that Web developers use to create interactive characters on Web pages. By tricking a Windows 2000 user into visiting a maliciously encoded Web page, an attacker could exploit this flaw to run unauthorized software on a victim's computer. This is not the first time Microsoft has been forced to patch a critical bug in Microsoft Agent. In April, the company fixed a similar flaw that also affected Windows XP users. Because the MSN Messenger and Windows Services for Unix flaws were both publicly disclosed last month, they should also be given priority said Amol Sarwate, manager of Qualys's vulnerability research lab. "They had both been known for awhile, but they are important," he said. "Especially the MSN vulnerability." MSN Messenger and Windows Live Messenger users will be prompted to upgrade their software when they connect with Microsoft's instant-messaging services, Microsoft said in its notes on the security update. "If you do not upgrade to a non-affected version of the MSN Messenger or Windows Live Messenger client, depending on your platform, you will be notified to upgrade on each attempt to sign on." MSN Messenger 7.0.0820 or Windows Live Messenger 8.1 are not vulnerable to the flaw, Microsoft said. The fourth patch issued Tuesday fixes a bug in Crystal Reports for Visual Studio. Attackers could run code on a victim's PC by getting them to open a specially crafted Crystal Reports RPT file, Microsoft said. Overall, the September updates are a far less serious group of patches than the nine updates Microsoft released last month. "Compared to last month, Patch Tuesday in September is almost anticlimactic," security vendor McAfee said in a statement. "Customers who have legacy applications installed on Windows Server 2000 Service Pack 4 should be paying the most attention, but we don't foresee a lot of exploitation of the Windows 2000 vulnerability. Not many people will use those systems to surf the Web, which would be the attack vector."
55054
Microsoft issues fixes for more than 20 holes in its software in its February security update.
433592
Well, it&#39;s &quot;Patch Day Tuesday&quot; again, and Microsoft just released another raft of security bulletins. We got ten bulletins this time, but that amounts to something upwind of 20 separate vulnerabilities
166796
Microsoft Corp. on Tuesday released 12 security fixes for its Windows operating system and Office business software.
713300
A stitch in time... Microsoft this week pushed out a patch to resolve a flaw in its patching system.â¦
630223
Just one day before Valentine's Day, Microsoft plans to release twelve patches fixing a variety of issues in Windows, Office, Visual Studio, and several other applications. At least five of these patches will be rated "critical."
616542
(InfoWorld) - Microsoft will release six sets of security patches next Tuesday, four of which will fix critical flaws in the Windows operating system. The software will be released as part of Microsoft's regular monthly security release, known informally as "Patch Tuesday." Microsoft is also planning less critical updates for Visio and Windows Vista, the company said in a note, published Thursday. Microsoft considers an update critical when the flaw could be used by an attacker to remotely run unauthorized software on the victim's machine, theoretically leading to the propagation of an Internet worm. This month, Microsoft has revealed a few more details on the upcoming patches than it has in the past. That's part ofÂ a new plan to help IT administratorsÂ better prepare for Patch Tuesday by letting them know exactly what versions of Microsoft's products will be affected by the updates. Last month, Microsoft released seven groups of patches on Patch Tuesday.
78946
Microsoft released 11 security updates Tuesday to&#160;fix critical flaws in its products, including a publicly known ActiveX bug that affects users of the Visual FoxPro database.In total, 17 individual software flaws were patched in the updates. Microsoft rates six updates as critical, meaning they should be installed as soon as possible, while the remaining five updates are considered &quot;important.&quot; Last month was an easier month on IT administrators, when Microsoft released just two updates.Microsoft surprised some by releasing one&#160;fewer update than expected. Last Thursday, the software vendor had said that it was&#160;readying a fix&#160;for critical VBScript and JScript flaws in Windows 2000, XP, and Windows Server 2003. That update wasn&#39;t included in this week&#39;s patches, but on Tuesday, Microsoft wouldn&#39;t confirm that it had actually dropped the update because &quot;this could put customers at risk,&quot; according a spokeswoman for the company&#39;s public relations agency.Security experts said Tuesday that the MS08-010 update, which fixes four bugs in Internet Explorer, should take top priority this week. &quot;There are four vulnerabilities within that particular patch and all of them are remote-code executable,&quot; said Jonathan Bitle, director of technical account management with Qualys.&quot;The way we&#39;re looking at it, our prioritization would put MS08-010 at the top, followed by MS08-007,&quot; said Don Leatham, director of solutions and strategy with Lumension Security.MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7&#39;s default list of controls, so the flaw should not affect most users.The MS08-007 update fixes a critical flaw in the Windows XP and Vista WebDAV redirector software. WebDAV is a Web-based document sharing protocol. The flaw is rated important for Windows Server 2003 users.Microsoft&#39;s Office products are also a major source of patches this month. Tuesday&#39;s updates include critical fixes for Microsoft Word, Office Publisher, and Office itself. There is also a critical update for Windows&#39; Object Linking and Embedding (OLE) Automation software. The remaining updates, rated important, are for Active Directory, the Vista TCP/IP stack, the Microsoft Works file converter, and two bugs in the Internet Information Services (IIS) Web server.The Patch Tuesday updates show that client-side bugs continue to be a much higher risk than server-side vulnerabilities, said Andrew Storms, director of security operations with nCircle. &quot;One would have assumed that the IIS and Active Directory vulnerabilities would have been the most serious because they stand at the core of an enterprise and provide more critical services,&quot; he said via instant message. &quot;But with this month&#39;s patches, the hacker&#39;s best bet is to take advantage of the client-side attacks.&quot;
391512
Slew of Patch Tuesday security updates will include "critical" fixes for Windows, Office and Microsoft's security tools.
22202
Microsoft Corp. released 10 security fixes for various products yesterday, including seven that fix flaws the company said pose the highest threat to users.
420747
VMware has patched critical flaws in its virtualization products.
437427
You've been warned Next week's Patch Tuesday will see Microsoft issue three updates that fix "critical" security vulnerabilities in Windows, Office and the .Net framework. The critical designation is Microsoft's most severe rating and usually applies to flaws that can allow a computer to be hijacked with little or no interaction on the part of the user.â¦
176052
Microsoft has issued a patch to fix the security flaw, and urges its customers to use a new utility to locate the computer applications that are vulnerable.
640711
Microsoft Corp.  on  Tuesday released three security patches to fix holes in its  Windows and Office software and warned one of the  vulnerabilities was "critical" because it could allow an  attacker to take over a user's computer.
101397
Microsoft plans to release patches for five Windows flaws next week, the software giant announced Thursday. The company posted the information on its TechNet site as part of a new program that gives the general
67079
Microsoft Corp has released a patch for its latest âcriticalâ rated security flaw affecting its Windows, Office and developer tools software programmes.