Microsoft Security Bulletin Summary for December 2007

Microsoft announced it’s security bulletins for the month of December today. It entails 3 Critical and 4 Important updates.

Critical:

  1. Vulnerabilities in DirectX Could Allow Remote Code Execution (941568)
  2. Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275)
  3. Cumulative Security Update for Internet Explorer (942615)

Important:

  1. Vulnerability in SMBv2 Could Allow Remote Code Execution (942624)
  2. Vulnerability in Message Queuing Could Allow Remote Code Execution (937894)
  3. Vulnerability in Windows Kernel Could Allow Elevation of Privilege (943078)
  4. Vulnerability in Macrovision Driver Could Allow Local Elevation of Privilege (944653)

Tags:

Windows – 1, Linux – 0

 

Remember the SBS 2003 Server I was taking over from another consultant that hadn’t been updated in 2+ years?

Yeah, flawless updating through all 5 SBS 2003 SP1 updates, Server 2003 SP2, Exchange SP2 and WSS SP2, as well as the accompanying 39+ patches after all the SP’s were in. Side effect of all the patching? Server now runs way snappier and I look kingly to the business.

The previous consultants departing gift was an update to their Linux firewall that hadn’t been updated in a year. End result was a firewall that ate itself during the upgrade and a forced reinstall of the entire box. The worst part of the botched upgrade was it happened at the beginning of business hours on Friday so the business was without internet until I could get in and pop a router into place until the other consultant could get onsite and reload the Linux box. The previous consultant is a friend of mine, so of course, I had a field day giving him a hard time.

The SBS 2003 update process took ~13 hours start to finish. 7 hours of that was a full backup of the server before I started the process, so ~6 hours for all the service packs and patches to go in. Part of that time was also dedicated to clearing out the Exchange queues of all the spam that had resided there for over a year after they got hit while using Exchange as their mail server. Once I get the chance to show them the beauty of Direct Push, I believe I can get them to swap back over and get them subbed to ExchangeDefender run by the (in)famous Vlad Mazek.

I did have the foresight of knowing that the Server 2003 SP2 caused issues if the NIC drivers were old, so that was the very first thing updated once the Server was taken down for a good cleaning out and put back online. I’m sure you’d like to hear about having to work around quirks that popped up during the updates, but there were absolutely none. Completely flawless start to finish. The previous consultant, being mostly Linux based, was highly impressed with the speed of the machine after updating. Security isn’t the only reason you should patch.

All in all, a win for the Windows Server product and a black-eye for the Linux product in the eyes of the business. Can’t say I’m unhappy about that.

Tags:

Patch Tuesday Notification

The Microsoft Security Response Center (MSRC) released their notifications today for patches coming to your nearest Update Center on July 10th, this coming Tuesday. A total of 6 updates, 3 Critical for Windows, 3 Critical for Office and 1 Important for .NET Framework will be coming down the tubes to harden your PC’s against potential attackers. There is also an official release at TechNet which shows 3 Critical, 2 Important and 1 Moderate so there is some conflicting patch information as far as I can tell. I looked for some contact info to be able to clarify which was correct, but none are listed.

From the Official release, the 3 Critical and 2 Important Updates all address remote code execution vulnerabilities in Windows, Office and .NET, while the Moderate update addresses an information disclosure hole in Vista.

There will also be 4 Non-Security Important updates as well as a new Malicious Software Removal Tool with the aforementioned updates.

Keep an eye out on MU and WSUS this coming Tuesday!

Tags:

Wordpress 2.2.1 Update Released

The WordPress team released a bug/security update today versioned at 2.2.1.

Bug fixes include:

Security fixes include:

Head on over and grab your fix or wait for the automatic patcher if your host provides that feature.

Tags:

Clicky Web Analytics