Old MS Alerts

[AplusWebMaster]

FYI...

Windows Vista Application Compatibility Update
- http://support.microsoft.com/kb/943302
Last Review: January 11, 2008
Revision: 2.0

.

[AplusWebMaster]

FYI...

Microsoft Security Advisory (947563)
Vulnerability in Microsoft Excel Could Allow Remote Code Execution
- http://www.microsoft.com/technet/sec...ry/947563.mspx
January 15, 2008 - "Microsoft is investigating new public reports of a vulnerability in Microsoft Office Excel 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2002, Microsoft Office Excel 2000, and Microsoft Excel 2004 for Mac. At this time, our initial investigation indicates that customers who are using Microsoft Office Excel 2007 or Microsoft Excel 2008 for Mac, or who have installed Microsoft Office Excel 2003 Service Pack 3 are not affected by this vulnerability. Microsoft is investigating the public reports and customer impact. Upon completion of this investigation, Microsoft will take the appropriate action... At this time, we are aware only of targeted attacks that attempt to use this vulnerability. Additionally, as the issue has not been publicly disclosed broadly, we believe the risk at this time to be limited...
Note: There are no known workarounds for Microsoft Office Excel 2002 or Microsoft Office Excel 2000 at this time..."

- http://isc.sans.org/diary.html?storyid=3854
Last Updated: 2008-01-16 02:54:29 UTC - "... The vulnerability is, according to the blog*, already actively exploited by targeted attacks. Excel 2003SP3 and Excel 2007 are not affected, but most other versions are."
* http://blogs.technet.com/msrc/archiv...ry-947563.aspx

- http://secunia.com/advisories/28506/
Release Date: 2008-01-16
Critical: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched...

[AplusWebMaster]

FYI...

- http://preview.tinyurl.com/364gvn
January 17, 2008 (Infoworld) - "...The code is not available to the general public (Ed. note: "Yet"). It was released Thursday to security professionals who use Immunity's Canvas computer security testing software. It causes the Windows system to crash but does not let the attacker run malicious software on the victim's system... The bug is particularly troublesome for two reasons. First, it affects a widely used Windows component that is turned on by default. Worse, no user interaction is required to trigger the flaw, meaning that it could be exploited in a self-copying worm attack. MS patched the flaw in its MS08-001 update**, released last week, but it takes time for enterprise users to test and install Microsoft's patches..."
* http://seclists.org/dailydave/2008/q1/0017.html
17 Jan 2008

** http://www.microsoft.com/technet/sec.../ms08-001.mspx
January 8, 2008 - Critical

- http://atlas.arbor.net/briefs/index#1659842965
January 17, 2008 - "...Analysis: Like we anticipated, an exploit is now available in limited release. However, this issue should not affect too many networks, as the attackers need subnet access to send the traffic to the victim..."

[AplusWebMaster]

FYI...

Microsoft Security Bulletin MS08-001 – Critical
Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644)
- http://www.microsoft.com/technet/sec.../MS08-001.mspx
• V2.0 (January 23, 2008): Bulletin updated to add Windows Small Business Server 2003 Service Pack 2 as an affected product. Also added an FAQ to clarify that current Microsoft detection and deployment tools already correctly offer the update to Windows Small Business Server 2003 Service Pack 2 customers.

[AplusWebMaster]

FYI... Microsoft Security Bulletin Re-Releases and Revisions

Microsoft Security Bulletin MS07-057 - Critical
Cumulative Security Update for Internet Explorer (939653)
- http://www.microsoft.com/technet/sec.../ms07-057.mspx
• V1.0 (October 9, 2007): Bulletin published.
• V1.1 (October 10, 2007): Bulletin revised to correct the "What does the update do?" section for CVE-2007-3893.
• V1.2 (January 09, 2008): Bulletin revised to add a known issue.
• V1.3 (January 23, 2008): Bulletin revised to address rendering issues.

Microsoft Security Bulletin MS07-064 – Critical
Vulnerabilities in DirectX Could Allow Remote Code Execution (941568)
- http://www.microsoft.com/technet/sec.../ms07-064.mspx
• V1.0 (December 11, 2007): Bulletin published.
• V1.1 (December 12, 2007): Bulletin updated to reflect that DirectX that ships on Windows 2000 is not supported by SMS 2.0 unless the Extended Security Update Inventory Tool (ESUIT) is used.
• V1.2 (December 19, 2007): Bulletin updated to reflect a change to the Removal Information text in the Windows Vista Reference Table portion of the Security Update Information section. Also removed the web-based mitigation from vulnerability CVE-2007-3901.
• V1.3 (January 9, 2008): Bulletin updated to remove known issues notation. This update does not have any known issues.
• V2.0 (January 23, 2008): Bulletin updated to reflect that the update for DirectX 9.0 also applies to DirectX 9.0b and DirectX 9.0c.

Microsoft Security Bulletin MS07-068 - Critical
Vulnerability in Windows Media File Format Could Allow Remote Code Execution (941569 and 944275)
- http://www.microsoft.com/technet/sec.../ms07-068.mspx
• V1.0 (December 11, 2007): Bulletin published...
• V1.2 (January 23, 2008): Bulletin updated to add an FAQ regarding installing the updates for Windows Media Format Runtime 9.5 on Windows XP Professional x64 Edition.

Microsoft Security Bulletin MS08-001 – Critical
Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644)
- http://www.microsoft.com/technet/sec.../ms08-001.mspx
• V1.0 (January 8, 2008): Bulletin published.
• V2.0 (January 23, 2008): Bulletin updated to add Windows Small Business Server 2003 Service Pack 2 as an affected product. Also added an FAQ to clarify that current Microsoft detection and deployment tools already correctly offer the update to Windows Small Business Server 2003 Service Pack 2 customers.

[AplusWebMaster]

FYI...

Microsoft Security Bulletin MS08-001 – Critical
Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644)
- http://www.microsoft.com/technet/sec.../ms08-001.mspx
• V3.0 (January 25 2008): This bulletin was revised to clarify the impact of Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability (CVE-2007-0069*) on supported editions of Windows Small Business Server 2003 and Windows Home Server. Also included is an explanation and clarification that current Microsoft detection and deployment tools already correctly offer the update to systems running Windows Small Business Server 2003 and Windows Home Server.
* http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0069

[AplusWebMaster]

FYI...

- http://preview.tinyurl.com/26fx8c
January 30, 2008 (Computerworld) - "... On Tuesday, Immunity Inc. updated a working exploit for the TCP/IP flaw spelled out Jan. 8 in Microsoft's MS08-001 security bulletin, and posted a Flash demonstration of the attack on its Web site. The exploit, which was released to customers of its CANVAS penetration testing software - but is not available to the public - was a revised version of code first issued two weeks ago... Other security companies reacted to the revamped attack code and Flash proof by issuing new alerts. Symantec Corp., for instance, sent a new warning to customers of its DeepSight threat network... It urged users who have not already deployed the patches Microsoft issued Jan. 8 to do (so) immediately..."

[AplusWebMaster]

FYI...

- http://news.yahoo.com/s/ap/20080201/...rosoft_yahoo_9
Feb. 1, 2008 - REDMOND, Wash. - "Microsoft Corp. is offering $44.6 billion in cash and stock for search engine operator Yahoo Inc. in a move to boost its competitive edge in the online services market. The unexpected announcement Friday comes as Microsoft, the world's biggest software company, seeks new ways to compete more efrfectively against the search and online advertising powerhouse Google Inc. In a letter to Yahoo's board of directors, Microsoft Chief Executive Steve Ballmer said the company will bid $31 per share, representing a 62 percent premium to Yahoo's closing stock price Thursday..."

- http://www.reuters.com/article/techn...080201?sp=true
Feb. 1, 2008 - "...Skeptics say Microsoft and Yahoo have very different corporate cultures and worry about a clash such as the one that marred AOL's $182 billion purchase of Time Warner in 2001, which is seen as the worst merger in recent history...."

[AplusWebMaster]

FYI...

- http://secunia.com/advisories/28715
Last Update: 2008-02-05
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: MySpace Uploader Control 1.x
...The vulnerability is confirmed in MySpaceUploader.ocx version 1.0.0.5 and reported in version 1.0.0.4. Other versions may also be affected.
Solution: Update to version 1.0.0.6. <<<

- http://secunia.com/advisories/28713/
Release Date: 2008-02-04
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: Facebook Photo Uploader 4.x
...The vulnerability is confirmed in version 4.5.57.0. Other versions may also be affected.
Solution: Update to version 4.5.57.1. <<<

- http://secunia.com/advisories/28757/
Last Update: 2008-02-07
Critical: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: Yahoo! Music Jukebox 2.x...
NOTE: Working exploit code is publicly available.
The vulnerabilities are confirmed in Yahoo! Music Jukebox version 2.2.2.056. Other versions may also be affected...
Solution: Set the kill-bit for the affected ActiveX controls. <<<
Other References:
US-CERT VU#101676: http://www.kb.cert.org/vuls/id/101676
US-CERT VU#340860: http://www.kb.cert.org/vuls/id/340860
---------------------
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0623
release date: 2/6/2008 - YMP Datagrid ActiveX control (datagrid.dll)
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0624
release date: 2/6/2008 - YMP Datagrid ActiveX control (datagrid.dll)
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0625
release date: 2/6/2008 - MediaGrid ActiveX control (mediagrid.dll)

[AplusWebMaster]

FYI...

- http://isc.sans.org/diary.html?storyid=3946
Last Updated: 2008-02-07 02:13:00 UTC - "Just a quick reminder to those in the corporate world and using WSUS. From a technet update email Volume 10, Issue 3: February 6, 2008

"...On February 12, 2008 Microsoft will release the Windows Internet Explorer 7 Installation and Availability update to Windows Server Update Services (WSUS). Windows Internet Explorer 7 Installation and Availability Update is a complete installation package that will upgrade machines running Internet Explorer 6 to Windows Internet Explorer 7. Customers who have configured WSUS to "auto-approve" Update Rollup packages will automatically upgrade machines running Internet Explorer 6 to Windows Internet Explorer 7 after February 12, 2008 and consequently, may want to read Knowledge Base article 946202 [links to http://go.microsoft.com/?linkid=8250930 ] to manage how and when this update is installed. For more on the Windows Internet Explorer 7 Installation and Availability Update, read Knowledge Base article 940767 [links to http://go.microsoft.com/?linkid=8250931 ]..."

There are still many organisations that use IE6 because of internal applications that may not work with IE 7 or alternate browsers. So if you use WSUS and have a need to stay with IE6, you should check out the knowledge base articles. Otherwise the 13th is not going to be a happy day for you."