Microsoft Sets A New Record

It’s the biggest Patch Tuesday ever!

Microsoft Again Sets Record With Massive Patch

For the third time this year, Microsoft has issued a record-setting security patch.

The company’s December Bulletin Release includes 17 security bulletins addressing 40 vulnerabilities in Microsoft Office, Windows, Internet Explorer, SharePoint Server and Exchange.

Jeff Prince, CTO of ConSentry sees NAS as evolving technology that won’t just be about initial host assessment. It was only in October that Microsoft set the record it just broke, with 16 security bulletins. There were however fewer individual vulnerabilities this month than in October (49). And it was two months earlier, in August, that the company had set its previous record, with 14 bulletins to address 34 vulnerabilities.

The huge October patch was supposed to front-load the task of patching so that IT administrators had a lighter schedule over the holidays. So much for that idea.

At least the December crop of bulletins brings only two “critical” ones. Fourteen are rated “important” and one is rated “moderate.”

The two critical bulletins, MS10-090 and MS10-091, addressing vulnerabilities in Internet Explorer and Windows respectively, should be deployed first, according to Microsoft.

See also:
It’s Microsoft Patch Tuesday: December 2010
Microsoft Security Bulletin Summary for December 2010
Microsoft Closes a Record-Patch Year with 17 for December
Windows Security Updates: Microsoft Critical Security Patches
Microsoft Fixes 40 Vulnerabilities in Final Patch Tuesday for 2010
Microsoft’s holiday bonus: Fixes for 40 flaws
Microsoft Fixes Dozens of Vulnerabilities in Big Update
Record Patch Tuesday: What You Need to Know
Microsoft Fixes 40 Flaws With Record Patch Tuesday Release
Microsoft Patch Tuesday: The bottom line
Microsoft fixes bugs in Windows, Internet Explorer
Windows Update

You better watch out! Better not cry! Better not pout! I’m telling you why, Patch Tuesday is comin’ to town.

/Merry Christmas, don’t forget to unwrap your shiny new present from Microsoft!

It’s Extra Special Patch Tuesday!

Yep, this gaping hole in Windows is so bad that Microsoft couldn’t even wait until next week’s regularly scheduled Patch Tuesday to try and fix it.

Microsoft issues emergency security patch for million dollar Windows flaw

Microsoft today rushed out an emergency patch for Windows Vista and Windows 7 PCs just eight days before its next Patch Tuesday.

The software giant issues security patches on the second Tuesday of each month, and only rarely issues so-called out-of-band patches. The company has never issued an emergency patch this close to Patch Tuesday, says Jason Miller, data and security team leader at patch management firm, Shavlik Technologies.

“Coming out with this patch this close to a Patch Tuesday is severe,” says Miller. “People should be paying attention to this one, and patch as soon as possible.”

Importantly, the emergency patch does nothing for hundreds of millions of PCs running Windows XP Service Pack 2 and Windows Server 2000, since Microsoft last month stopped issuing security updates for those older versions of its flagship operating system. The company continues to urge Windows XP SP2 users, in particular, to upgrade to Windows XP SP3, which will continue to get security updates, or to buy new Windows 7 PCs.

Update: To be clear, this patch will work on Windows XP SP3, Windows Server 2003 SP2; Windows Vista, Window Server 2008, Windows 7, Windows Server 2008 R2. It will not work on Windows XP SP2 or Windows Server 2000.

At the Black Hat and Def Con security conferences in Las Vegas last week, attendees referred to this Windows flaw as a $1 million vulnerability. Savvy hackers can tweak a basic component of all versions of Windows, called LNK. This is the simple coding that enables shortcut program icons to appear on your desktop.

No one in the legit world knew the LNK flaw existed until mid July, when security blogger Brian Krebs began reporting on a sophisticated worm spreading via USB thumb drives. That worm, known has Stuxnet, took advantage of the newly-discovered flaw to run a malicious program designed specifically to breach Siemens SCADA (supervisory control and data acquisition) software systems. Over a period of months the attackers had infected Siemens SCADA controls in power plants and factories in Iran, Indonesia, India and some Middle East nations, according to antivirus firm Symantec.

See also:
Microsoft Security Bulletin MS10-046 – Critical
Microsoft ships rush patch for Windows shortcut bug
Microsoft issues emergency patch for Windows shortcut link vulnerability
Microsoft Patches Windows Shell Vulnerability
Microsoft’s New Patch for Windows Shortcut Exploit
Emergency patch closes LNK hole in Windows
Microsoft sticks to plan, denies emergency patch for XP SP2

The new emergency patch is here, the new emergency patch is here!

/so, if your Windows didn’t automatically update, you’d better do it now