Microsoft releases Patch Tuesday security updates
691908
(InfoWorld) - Microsoft has released its security patches for September, fixing known vulnerabilities in its MSN Messenger software and Unix services for Windows as well as a critical bug in Windows 2000. In total, Microsoft patched four bugs in its products. This was one less update than expected following the software maker's last-minute decision to scrap a fix for its SharePoint collaboration software. The Windows 2000 update is the only one Microsoft rates as critical. It affects the Microsoft Agent software that Web developers use to create interactive characters on Web pages. By tricking a Windows 2000 user into visiting a maliciously encoded Web page, an attacker could exploit this flaw to run unauthorized software on a victim's computer. This is not the first time Microsoft has been forced to patch a critical bug in Microsoft Agent. In April, the company fixed a similar flaw that also affected Windows XP users. Because the MSN Messenger and Windows Services for Unix flaws were both publicly disclosed last month, they should also be given priority said Amol Sarwate, manager of Qualys's vulnerability research lab. "They had both been known for awhile, but they are important," he said. "Especially the MSN vulnerability." MSN Messenger and Windows Live Messenger users will be prompted to upgrade their software when they connect with Microsoft's instant-messaging services, Microsoft said in its notes on the security update. "If you do not upgrade to a non-affected version of the MSN Messenger or Windows Live Messenger client, depending on your platform, you will be notified to upgrade on each attempt to sign on." MSN Messenger 7.0.0820 or Windows Live Messenger 8.1 are not vulnerable to the flaw, Microsoft said. The fourth patch issued Tuesday fixes a bug in Crystal Reports for Visual Studio. Attackers could run code on a victim's PC by getting them to open a specially crafted Crystal Reports RPT file, Microsoft said. Overall, the September updates are a far less serious group of patches than the nine updates Microsoft released last month. "Compared to last month, Patch Tuesday in September is almost anticlimactic," security vendor McAfee said in a statement. "Customers who have legacy applications installed on Windows Server 2000 Service Pack 4 should be paying the most attention, but we don't foresee a lot of exploitation of the Windows 2000 vulnerability. Not many people will use those systems to surf the Web, which would be the attack vector."
372618
Microsoft plans to release a dozen security updates next week to patch critical vulnerabilities in Windows, Office, Visual Studio and in its anti-virus software.
164550
The software giant says it will release five sets of security patches next Tuesday, including a critical update for users of Windows 2000.
592740
Microsoft issued seven patches on Tuesday as part of its monthly Patch Tuesday cycle, with three updates receiving the dreaded "critical" rating. While Redmond did not issue an update for the newly discovered Word vulnerabilities, the software giant said it is still working on a fix for the two critical flaws that have been the target of numerous hack attacks since last week.
668678
On Thursday, Microsoft gave I.T. administrators a sneak peak of next week&#39;s security updates. June&#39;s Patch Tuesday will see six sets of software patches. Four of those six will fix critical flaws in Windows and related software.
541400
Microsoft today released a dozen security updates to fix a score of vulnerabilities in various products, including a "critical" patch for its own security software.
744189
InfoWorld - Microsoft plans to issue two security updates for its Windows operating system products next Tuesday as part of its regular software patch cycle.
735918
Microsoft Corp. published six security fixes &#151; half of them rated "critical" &#151; in its regularly scheduled software update Tuesday.
329764
Microsoft Corp. issued six  "critical" security patches on Tuesday to fix flaws in its  software products that the company warned could allow attackers  to take control of a user's computer.
311958
Microsoft has released a patch for what it is calling a &quot;critical&quot; security flaw in the way many of its programs handle JPEG graphics files.
67079
Microsoft Corp has released a patch for its latest âcriticalâ rated security flaw affecting its Windows, Office and developer tools software programmes.
526721
Microsoft Corp. released four software patches Tuesday to fix security flaws, including one that could allow hackers to take over computers running the company's instant messaging programs.
739239
(InfoWorld) - Microsoft Corp. has rolled out its monthly security updates for December, patching critical flaws in Internet Explorer, Windows Media Format, and the Visual Studio 2005 development software. The seven security patches address 11 bugs, including two in the Windows Media Player software. However, no fixes were provided for two Microsoft Word flaws that have been used in a small number of attacks during the past week. Microsoft had said it would release only six patches on Tuesday, but the company added the Windows Media Format update at the last minute, after reports of attacks based on this vulnerability began surfacing. The Windows Media Format is used by Microsoft's Windows Media Player software. In late November, security vendors warned that a buffer overflow error could occur when the Windows Media Player processed ".asx" (Advanced Stream Redirector) media files, meaning that users would first need to be tricked into opening a malicious media file for the attack to work. In its update Tuesday, Microsoft also patched a similar bug in the way the media player processes ".asf" (Advanced Systems Format) files. The Internet Explorer patch fixes four bugs. It is also rated critical, and is noteworthy because some of these bugs will probably begin to be exploited by hackers by week's end, said Gunter Ollmann, director of IBM Corp.'s Internet Security System's X-Force threat analysis service. Enterprise administrators should also pay close attention to an SNMP (Simple Network Monitoring Protocol) patch issued Tuesday, Ollmann said. Microsoft has rated this patch as "important," rather than critical because SNMP is normally blocked at the firewall and turned off by default on Windows systems. However, it is widely deployed as part of the network monitoring infrastructure in the enterprise, and is often used on critical servers, Ollmann said. Ollmann believes this SNMP patch is the "most important" update for enterprise customers. "Since the service is widely deployed in the enterprise and since it's commonly deployed on servers, we think this would be an important attack vector for enterprises," he said. The remaining updates include a "critical" fix for Visual Studio 2005, and "important" updates for Windows and Outlook Express, Microsoft said. Microsoft defines "critical" flaws as bugs that could allow the propagation of an Internet worm without any action on the part of the victim. The company's next set of security updates are due Jan. 9.
611148
Microsoft Corp. released 10 security fixes for various products Tuesday, including seven that fix flaws the company said pose the highest threat to users.
216439
Acknowledging that its patching process has "not been an example of our best work," Microsoft this week issued a second update to security bulletin MS06-042, which was released in August. The original patch included a security vulnerability - and it turns out the fix introduced even more.
232414
Microsoft today included a set of nonsecurity updates to prepare customers to install Windows Vista Service Pack 1 as part of its monthly "Patch Tuesday" security fixes.
212495
Microsoft will release six security updates for Windows and Visual Studio next week.