Ramblings of an old Doc

 

Microsoft will be sending us 16 bulletins covering a wide range of security holes in the Windows operating system.

Of the 16 bulletins. nine are rated “critical” because of the risk of remote code execution attack.

Adobe rates security issues in the same manner as Microsoft.

Two of the critical bulletins will address high-severity vulnerabilities in iE.

The following products are also getting patched in this month’s patch batch:

Microsoft .NET Framework

Microsoft Silverlight

Microsoft Forefront Threat Management Gateway

Microsoft Office

Microsoft SQL Server

Microsoft Visual Studio

All supported versions of Windows are affected by this month’s patches, which are scheduled for release this Tuesday (June 14).

Adobe will also fix critical security vulnerabilities in the Adobe PDF Reader and other Adobe Acrobat software products.

These vulnerabilities, also expose users to code execution attacks via rigged PDF files, affect both Windows and Mac OS X users.

Software versions affected by the vulnerabilities fixed in this patch batch include:

Adobe Reader X (10.0.1) and earlier versions for Windows

Adobe Reader X (10.0.3) and earlier versions for Macintosh

Adobe Reader 9.4.3 and earlier versions for Windows and Macintosh

Adobe Acrobat X (10.0.3) and earlier versions for Windows and Macintosh

Adobe Acrobat 9.4.3 and earlier versions for Windows and Macintosh

 

Sources:

http://www.eweek.com/c/a/Security/Microsoft-Plans-16-Security-Bulletins-for-Junes-Patch-Tuesday-154508/

http://www.infosecurity-us.com/view/18596/adobe-quarterly-patch-to-plug-critical-flaws-in-reader-and-acrobat/

 


Comments (Page 1)
4 Pages1 2 3  Last
on Jun 11, 2011

Roll up your sleeves boys and girls here we go again. Thanks Doc for staying on top of this stuff. Weren't for you I think most of us would be carrying around a can of Raid to kill all the bugs, a host of antibiotics for the viruses plus a really big broom and dustpan to sweep out all the mallware. Jeez....I got enough to carry around as it is.

on Jun 11, 2011

That means Wednesday for me.  Wonder why I get them the next day all the time?

on Jun 11, 2011

If you open the update utility it should actively seek the updates.... Perhaps waiting for it to 'find' you is the difference?  Windows Update can be configured to install critical updates automatically so long as the computer is connected to the Internet, without the user needing to install them manually, or even be aware that an update is required .

on Jun 11, 2011

Of the 16 bulletins. nine are rated “critical” because of the risk of remote code execution attack.

question: does this deal with the remote windows setting and if so if it's turned off....

on Jun 11, 2011

Yes it does, gmc2. http://www.sophos.com/support/knowledgebase/article/113194.html 

The patch should remove that vulnerability without "turning it off" as far as I know.

"Executive Summary

This security update resolves a publicly disclosed vulnerability in
Windows Remote Desktop Client. The vulnerability could allow remote code
execution if a user opens a legitimate Remote Desktop configuration (.rdp) file
located in the same network folder as a specially crafted library file. For an
attack to be successful, a user must visit an untrusted remote file system
location or WebDAV share and open a document from this location that is then
loaded by a vulnerable application.

This security update is rated Important for Remote Desktop
Connection 5.2 Client, Remote Desktop Connection 6.0 Client, Remote Desktop
Connection 6.1 Client, and Remote Desktop Connection 7.0 Client. For more
information, see the subsection, Affected and Non-Affected
Software
, in this section.

The security update addresses the vulnerability by correcting the
manner in which the Windows Remote Desktop Client loads external libraries. For
more information about the vulnerability, see the Frequently Asked Questions
(FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. The majority of customers have
automatic updating enabled and will not need to take any action because this
security update will be downloaded and installed automatically. Customers who
have not enabled automatic updating need to check for updates and install this
update manually. For information about specific configuration options in
automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who
want to install this security update manually, Microsoft recommends that
customers apply the update at the earliest opportunity using update management
software, or by checking for updates using the Microsoft
Update
service." - MS Technet

on Jun 11, 2011

DrJBHL
The patch should remove that vulnerability without "turning it off" as far as I know.

I can understand why it is used but I have never had the need and therefore it has always been turned off. thanks

on Jun 11, 2011
gmc2... It's always turned off, and you never use it. If so, why did you ask the question?
on Jun 11, 2011

.

on Jun 11, 2011

DrJBHL
gmc2... It's always turned off, and you never use it. If so, why did you ask the question?

just checking Doc. And I think the default setting is "on" but, it allows me the option of updating or not. makes sure that  I understand what the updates are about, answering a general curious question, terminology verification, etc.

why do you ask?

on Jun 11, 2011

Hey DC...what's with the invisible post? Can't see what you're not typing.

on Jun 11, 2011

Doc - I've seen you making quite a few good posts and I've checked out many things as a result - what sites do you check on a regular basis?

on Jun 12, 2011

Hey DC...what's with the invisible post? Can't see what you're not typing.

I was being Lazy just used a dot (.)  instead of (To find this post again)

on Jun 13, 2011

While 16 seems like a lot (and is), none are 0 day, which is good.  I do not care if they issue 36 - as long as none are 0 day.  It shows they are being at least somewhat proactive.

on Jun 13, 2011

OMG_pacov
Doc - I've seen you making quite a few good posts and I've checked out many things as a result - what sites do you check on a regular basis?

Thank you. About 10 or 12 of them, but always lifehacker.com and gizmodo.com pcmag.com and engadget.com .

That help?

Dr Guy
While 16 seems like a lot (and is), none are 0 day, which is good.  I do not care if they issue 36 - as long as none are 0 day.  It shows they are being at least somewhat proactive.

True, but surprises pop up all the time, and frequently depend on security firms. At least they seem to be quite open to fixing stuff as it comes up. 

on Jun 14, 2011

102 mb worth of updates. 15 total all important and one optional and of course you know what that one is....I(Yuck)E9. Download just starting.

4 Pages1 2 3  Last