All the latest UK technology news, reviews and analysis
|
|
|
14 Oct 2009
Microsoft has released the October 2009 edition of its monthly security update. The latest Patch Tuesday offering comprises 13 separate bulletins addressing 34 flaws in various components of Windows, Internet Explorer and Office.
Eight of the 13 bulletins have been given a security rating of 'critical', Microsoft's highest alert level. The remaining five have been rated 'important'.
The eight 'critical' bulletins include fixes for components in Server Message Block, Windows Media Player and Runtime, as well as software for Internet Explorer, Active Template Library, .NET and GDI Library. All flaws could allow an attacker to remotely execute code on a targeted system.
The five 'important' bulletins include two fixes for remote code execution flaws, as well two patches for denial-of-service vulnerabilities, a spoofing flaw and an elevation of privilege vulnerability.
Four updates for Windows 7 include three rated 'important' and one 'critical'. Microsoft plans to formally release Windows 7 on 22 October.
The company said that the update will also contain a reissue for a previously patched flaw in the XML Core Services component of Windows to expand the coverage of the patch.
Users can download the security update through the Microsoft Update application or from the company's security site.
Latest stories from Security
Related articles
Related jobs
Poll
What is the most important IT priority for your company this year?
Sneak peek at the forthcoming glass-based machine
Connect with V3.co.uk
This paper focuses on a series of best practices and techniques for development teams looking to improve their software development processes
Why good data management at all levels is essential in the modern business (video, 6mins)
Roc Search (ISEB, Automation, QA, Agile, Manual, Automation...
My Client is a reputable WORLD WIDE Systems Integrator...
My Client is a reputable WORLD WIDE Systems Integrator...
My Client is a well funded specialist in delivering secure...
Keep up to date with the latest products, services and technologies from the world's leading IT companies. IThound.com brings you over 2,000 white papers, case studies and analyst reports.
Do you agree?
MS-Update overwrites Internet Oprions - beware
These updates overwrote the XP Internet Options (Programs) for email etc. (I use Mozilla Thunderbird) changing it to Microsoft Outlook as well as changing other program settings. Although this is a REGULAR IRRITANT of many updates (I am a MS-Partner), THE MOST IRKING aspect of this update was the fact that the start-bar icon for Thunderbird (E-Mail) was changed to MS-Outlook. So starting email tried to configure Outlook.... I am fed up of being in a "permanent beta-test" of MS software and am now looking to move ALL of my systems to MAC... We already have one system and are VERY PLEASED with it indeed.
Posted by: Wyn Pugh 15 Oct 2009
Administrators will have a fit!
Your right - a hefty load! This is the first time Windows 7 and Windows 2008 R2 are affected by security bulletins. The sheer volume of bulletins and subsequent patches this month will most likely give administrators a fit. Following on from your article and in more detail: two previously active Microsoft Security Advisories have been closed out: ? Security Advisory 975497: Vulnerabilities in SMB Could Allow Remote Code Execution ? Security Advisory 975191: Vulnerabilities in the FTP Service in Internet Information These security advisories have been addressed with the new security bulletins MS09-050 and MS09-053. MS09-050 resolves three software vulnerabilities and is rated Critical. A user can send malicious networking packets to a target system that can lead to remote code execution on the target system. This code was already publically available, so the likelihood of a new major outbreak is unlikely. MS09-053 resolves two software vulnerabilities in the FTP service. These vulnerabilities could result in remote code execution on the target machine. The vulnerabilities covered by these bulletins were both publically known. The User Experience: Two bulletins affect the "User Experience" this month. MS09-054 is Microsoft's cumulative security update for the Internet Explorer browser. This bulletin addresses four vulnerabilities, one that is publically known, and is rated Critical. Users can be affected if they visit a specially crafted web page. This can lead to remote code execution. MS09-062 affects GDI+. The bulletin addresses an issue where specially crafted images can be embedded in web pages. If a user visits a specially crafted web page, a vulnerability can be exploited that can lead to remote code execution. In addition, opening specially crafted Microsoft Office documents can result in remote code execution as well. These will probably be the most targeted as both attack vectors have a large user base and require simple navigation to a malicious web site. In both cases, users must be enticed to visit a malicious web site or open a malicious Office document. The Media Experience: The next two bulletins affect media playing on target systems. MS09-051 affects the Windows Media Runtime component. If a user opens a malicious streaming media file (ASF), an attacker could gain complete control of the system through remote code execution. An attacker would need to entice a user to visit a website or opening a file to exploit this vulnerability. This bulletin is rated as Critical and addresses two software vulnerabilities. One of these vulnerabilities is publically known. MS09-052 is very similar to the previous security bulletin. This bulletin affects Windows Media Player, addresses one software vulnerability, and is rated Critical. The vulnerability has the same attack vectors as MS09-051 with one more addition. With Windows Media Player, a user would simply need to navigate to a directory containing a malicious file through explorer. Simply browsing to the folder, and not opening the file, will trigger the exploit. ATL Part Two: A few months back, Microsoft released an out-of-band that addressed software vulnerabilities with ATL components. This month, Microsoft is back with a few more patches that address ATL issues. First, MS09-055 is a bulletin that will place Active-X killbits on a machine. This will prevent malicious Active-X controls from opening. This bulletin fixes one software vulnerability and will block 15 malicious Active-X controls from running. There were reports of exploits in the wild taking advantage of this vulnerability. MS09-060 addresses three vulnerabilities in ATL Active-X controls in Microsoft Office. Users can be affected if they are enticed into navigating to a malicious website that can lead to remote code execution. This bulletin is rated as Critical. The Rest: ? MS09-061 addresses three vulnerabilities affecting .NET and Silverlight 2 and is rated Critical. If a user visits a malicious website, an attacker can gain Remote Code execution. ? MS09-057 addresses one vulnerability in the Windows Indexing Service and is rated Important. Like other vulnerabilities, it requires a user to navigate to a malicious website. But, the user needs to have a vulnerable binary on the target system for the exploit to work. This could lead to remote code execution on the target system. Based on the difficulty of the attack scenario, an exploitation outbreak on the vulnerability is lower than the other User Experience vulnerabilities. ? MS09-058 addresses three vulnerabilities in the Windows Kernel. This bulletin is rated as Important. An attacker would need to have access to a target system before being able to exploit this vulnerability. If successful, the attacker could cause a Denial of Service or elevate their privileges on the system. In order to exploit this vulnerability, an attacker would need to combine this exploit with additional exploits to gain access to the target system. ? MS09-056 addresses two vulnerabilities in CryptoAPI and is rated Important. This vulnerability can lead to a spoofing attack. If an attack is successful, an attacker can impersonate another user by displaying a digital certificate that appears to be legitimate. ? MS09-059 addresses one vulnerability in Local Security Authority Subsystem (LSASS) and is rated Important. This vulnerability can lead to a Denial of Service attack. If an attack is successful, the target system could automatically restart itself causing a Denial of Service. As this is October, Adobe has also released their quarterly security bulletins for Adobe Acrobat and Reader. Adobe will be releasing Adobe Reader and Acrobat for versions 9.1.3, 8.1.6 and 7.1.3. Re-released: Microsoft has re-released a new major revision to MS08-069. This bulletin now includes patches affecting Windows 7 and Windows 2008 R2 Hope this is of interest to you and your readers!
Posted by: Jason Miller, Security and Data Team Manager, Shavlik Technologies 14 Oct 2009