Tuesday Fun With Microsoft

The new patches are here, the new patches are here!

Microsoft Patches 17 Bugs in December Patch Tuesday

Microsoft fixed 17 bugs in the Windows operating system, Microsoft Office, Windows Media Player and Internet Explorer. The fixes also cover a zero-day flaw exploited by the Duqu Trojan.

Microsoft released 13 security bulletins to fix 17 different vulnerabilities as part of its December Patch Tuesday update, according to the advisory released Dec. 8. Three bulletins were marked critical and the remaining 10 were rated important.

See also:
Microsoft Security Bulletin Summary for December 2011
Merry Christmas! Microsoft Plans Massive Patch Tuesday to Close 2011
Last Patch Tuesday of 2011 Secures Windows XP, Vista, Windows 7
December 2011 Patch Tuesday sees 13 Microsoft bulletins, Duqu patch
Microsoft fixes 20 bugs in year’s last ‘Patch Tuesday’
Microsoft to patch three critical holes
Microsoft slims final patch Tuesday of 2011 to 13 patches from proposed 14
No BEAST fix from Microsoft in December patch batch
Microsoft fixes Duqu hole, but not BEAST problem
Microsoft scratches BEAST patch at last minute, but fixes Duqu bug
December Patch Tuesday Fixes Duqu Worm
‘Duqu’ zero-day Windows flaw patched this week
Microsoft: Duqu patched, bringing years total to 99 corrections

Well, it’s a good thing that Microsoft finally patched against the Duqu virus, better late than never, as they say. What are you waiting for? Start installing your gifts!

/at least you can’t say Microsoft didn’t get you anything for the Holidays

Advertisements

It’s Tuesday, Time To Download Microsoft Patches

And this Tuesday, there’s an extra big heapin’ helpin’ of downloadin’ fun!

Microsoft Issues Huge Patch Tuesday Fix for Windows, IE

Microsoft today released a batch of 17 security updates for a Patch Tuesday that cover 64 vulnerabilities in Microsoft Windows, Office, Internet Explorer, Visual Studio, .NET Framework and GDI+.

Nine of the bugs are rated critical, while eight are important. One of the “important” bulletins includes 30 vulnerabilities in one bug, MS11-034, and they all share the same couple of root causes, Microsoft said.

Microsoft identified three vulnerabilities as its top priority bulletins for the month: MS11-020, which resolves a problem with Windows that could allow remote code execution if an attacker created a specially crafted SMB packet and sent the packet to an affected system; MS11-019, another Windows bug that could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request; and MS11-018, which could allow remote code execution if a user views a specially crafted Web page using Internet Explorer.

See also:
Microsoft Security Bulletin Summary for April 2011
Tackling the Massive Microsoft Patch Tuesday
Microsoft fixes IE, SMB bugs in big Patch Tuesday
Researcher confirms kernel bugs will dominate Patch Tuesday
Microsoft Smashes Patch Tuesday Record With Massive Update
Another Microsoft Patch Tuesday, 64 New Flaws To Fix
Microsoft Pushes Giant Security Patch
Microsoft delivers monster security update for Windows, IE
Microsoft Releases Torrent of Security Updates
Windows Update

It’s another record! Will Windows software ever be fully patched?

/probably not, so see ya next time, and have a good time downloading, this one takes quite a while!

Do You Know What Day Is It?

You know damn well what day it is, it’s Microsoft Patch Tuesday!

Microsoft Plugs 22 Security Vulnerabilities on Patch Tuesday

Microsoft plugged 22 security holes today in the second Patch Tuesday of the year.

The fixes are included in 12 security bulletins spanning Windows, Internet Explorer, Microsoft Office and IIS. Three of the bulletins are rated “critical” while the other nine are considered “important.”

Within the critical bulletins are fixes for a bug in the Windows Graphics Rendering Engine Microsoft warned users about in January, as well as a vulnerability in IE (Internet Explorer) resulting from the creation of uninitialized memory during a CSS (cascading style sheet) function within IE. The company issued the advisory for the IE flaw in December, and has seen limited, targeted attacks focused on the vulnerability.

See also:
Microsoft Security Bulletin Summary for February 2011
Microsoft patches Windows, IE
Microsoft Fixes 22 Security Holes – 6 Critical
Microsoft’s Patch Tuesday: 6 Critical Fixes
Microsoft Patch Tuesday Swats 22 Bugs, Misses MHTML Flaw
How to Prioritize Microsoft Patch Tuesday
Bug bounty program reveals 22 unpatched flaws, 5 in Office
Microsoft delivers ‘big month’ of patches, quashes 22 bugs
February Microsoft Patch Targets 20-Plus Security Flaws
Microsoft patches critical flaws in IE, Windows Shell Graphics
Microsoft addresses 22 vulnerabilities in monthly patch release
Microsoft finally says adios to Autorun
Microsoft Update Trims USB AutoRun For Security
Windows Update

Who Nellie, that’s a whole lot of patch! And, as usual, it doesn’t even correct all the problems with the software.

/so, until next time, happy patching!

If It’s Tuesday, It Must Be Microsoft Patch Day

Pack a lunch, it’s massive.

Patch Tuesday Updates Fix Critical Flaws in IE and DirectShow

Microsoft’s Patch Tuesday for June 2010 is here. Microsoft released a total of 10 new security bulletins, addressing 34 separate vulnerabilities, including critical flaws in DirectShow and the Internet Explorer Web browser. Let’s turn to some industry experts and security professionals for additional insight on the Microsoft security bulletins, and perspective on how to prioritize and protect against the potential threats.

Seven of the security bulletins are rated as Important, while the remaining three are Critical. The Critical security bulletins include MS10-033 for DirectShow, and MS10-035 which addresses six different vulnerabilities in Internet Explorer.

Joshua Talbot, security intelligence manager for Symantec Security Response, points out that “This is the largest Microsoft patch release of 2010 and ties the record for the most vulnerabilities ever addressed in a single month; a record set in October of last year. This month’s release also features the largest ever single bulletin, with 14 vulnerabilities in Excel being addressed together.”

See also:
Microsoft plugs critical holes in huge Patch Tuesday
Microsoft emphasizes three critical updates on patch-heavy Tuesday
Microsoft Issues Critical IE Fix In 10-Patch Update
Microsoft issues 10 patches as part of June update
Microsoft: 10 security bulletins, 34 vulnerabilities for Patch Tuesday
Microsoft patches IE8’s Pwn2Own bug in massive update
Microsoft finally fixes Pwn2Own browser flaw
Windows Update

The update takes a while to download and install, but several of the patches are critical.

/so, you know what you need to do, get in their and protect your computer from the evil doers

Microsoft Cleans Up After Chinese Hack Of Google, Obama Turns The Other Cheek

Microsoft to release patch for IE hole on Thursday

Microsoft said on Wednesday that it will release on Thursday a patch to fix the latest hole in Internet Explorer that was used in the China-based attack on Google and for which an exploit has been released on the Internet since last week.

The company plans to release the patch as close to 10 a.m. PST on Thursday as possible and host a public Webcast at 1 p.m. PST, according to the security advisory.

Microsoft continues to see limited attacks and has only seen evidence of successful attacks against Internet Explorer 6, according to Jerry Bryant, senior security program manager at Microsoft.

“This is a standard cumulative update, accelerated from our regularly scheduled February release, for Internet Explorer with an aggregate severity rating of Critical,” he said in a statement.

“It addresses the vulnerability related to recent attacks against Google and a small subset of corporations, as well as several other vulnerabilities. Once applied, customers are protected against the known attacks that have been widely publicized,” Bryant said. “We recommend that customers install the update as soon as it is available. For customers using automatic updates, this update will automatically be applied once it is released.”

Vulnerable software is IE 6 on Microsoft Windows 2000 and IE 6, 7, and 8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, Microsoft said.

So, while China continues its relentless, covert cyberwar against U.S. and other Western commercial, government, and military targets, stealing information and secrets and causing economic and national security damage to our computer networks, guess what the Obama administration has decided to do, against the advice of U.S. intelligence officials and experts?

China removed as top priority for spies

The White House National Security Council recently directed U.S. spy agencies to lower the priority placed on intelligence collection for China, amid opposition to the policy change from senior intelligence leaders who feared it would hamper efforts to obtain secrets about Beijing’s military and its cyber-attacks.

The downgrading of intelligence gathering on China was challenged by Director of National Intelligence Dennis C. Blair and CIA Director Leon E. Panetta after it was first proposed in interagency memorandums in October, current and former intelligence officials said.

The decision downgrades China from “Priority 1” status, alongside Iran and North Korea, to “Priority 2,” which covers specific events such as the humanitarian crisis after the Haitian earthquake or tensions between India and Pakistan.

The National Security Council staff, in response, pressed ahead with the change and sought to assure Mr. Blair and other intelligence chiefs that the change would not affect the allocation of resources for spying on China or the urgency of focusing on Chinese spying targets, the officials told The Washington Times.

White House National Security Council officials declined to comment on the intelligence issue. Mike Birmingham, a spokesman for Mr. Blair, declined to comment. A CIA spokesman also declined to comment.

But administration officials, speaking on the condition of anonymity, said the new policy is part of the Obama administration’s larger effort to develop a more cooperative relationship with Beijing.

See also:
Microsoft Security Bulletin Advance Notification for January 2010
New IE hole exploited in attacks on U.S. firms
Microsoft Scrambles to Patch Browser
Microsoft patching “Google hack” flaw in IE tomorrow
Microsoft Security Bulletin MS10-002 Coming Thursday for IE Zero-Day
Microsoft to issue “Google attack” browser patch
Microsoft to issue emergency IE patch Thursday
Microsoft will issue emergency IE patch on Thursday
China removed as top priority for spies
China no longer top priority for intelligence gathering: White House
‘China no longer top priority for intelligence gathering’
China: Still an Intelligence Priority

Relax, don’t worry, the country is in the very best of hands.

/Obama’s NSC, more than a dozen morons stuffed in a four passenger clown car

You’re Going To Get IE8 Whether You Like It Or Not

Microsoft tired of waiting

Microsoft, disappointed by the low adoption rate for the company’s latest iteration of its Internet Explorer web browser, will from next week begin pushing the software to computer users through the Windows automatic update feature.

The target in the drive to expand use of Internet Explorer 8 (IE8) is the more than 90% of the IE user base still on versions six and seven. According to research firm Net Applications, IE8’s share of the IE market has reached 4.36% but overall IE share dropped to 60.90% this month.

See also:
Microsoft to start pushing IE 8 browser
Microsoft To Push Automatic Rollout For Internet Explorer 8
Internet Explorer 8 to hit Automatic Update
Microsoft rolls out automatic Internet Explorer 8 update
Why you should not install Internet Explorer 8
Internet Explorer 8 has good, bad sides

I tried installing IE8 a couple times a month or so ago, but it refused to open some of the websites on my Favorites list so I uninstalled it and went back to IE7.

/so, you’ve been warned, if you don’t want IE8, pay attention to which automatic updates you install next week