Microsoft Alerts

[AplusWebMaster]

FYI...

Microsoft Security Advisory (2737111)
Vulnerabilities in Microsoft Exchange and FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution
- https://technet.microsoft.com/en-us/...visory/2737111
• V2.0 (August 14, 2012): Advisory updated to reflect publication of security bulletin for Microsoft Exchange.
... MS12-058* addresses this issue for Microsoft Exchange.
* https://technet.microsoft.com/en-us/...letin/ms12-058

Microsoft Security Advisory (2661254)
Update For Minimum Certificate Key Length
- https://technet.microsoft.com/en-us/...visory/2661254
August 14, 2012 - Ref:
> http://support.microsoft.com/kb/2661254
... Update for minimum certificate key length
August 14, 2012 - Revision: 1.6

>> http://forums.spybot.info/showpost.p...1&postcount=42

[AplusWebMaster]

FYI...

Microsoft Security Bulletin MS12-043 - Critical
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)
- https://technet.microsoft.com/en-us/...letin/ms12-043
V2.0 (August 14, 2012): Bulletin re-released to offer the security updates for Microsoft XML Core Services 5.0 that were unavailable at the time of initial release. Customers running Microsoft XML Core Services 5.0 should apply the KB2687324, KB2596856, or KB2596679 update to be protected from the vulnerability described in this bulletin. Customers who have already successfully installed the updates originally offered on July 10, 2012 for Microsoft XML Core Services 3.0, Microsoft XML Core Services 4.0, and Microsoft XML Core Services 6.0 do not need to take any action. See the Update FAQ for details...

- http://support.microsoft.com/kb/2687324
Last Review: August 14, 2012 - Revision: 1.9

- http://support.microsoft.com/kb/2596856
Last Review: August 14, 2012 - Revision: 1.0

- http://support.microsoft.com/kb/2596679
Last Review: August 14, 2012 - Revision: 1.2

[AplusWebMaster]

FYI...

Microsoft Security Advisory (2743314)
Unencapsulated MS-CHAP v2 Authentication Could Allow Information Disclosure
- https://technet.microsoft.com/en-us/...visory/2743314
August 20, 2012 - "Microsoft is aware that detailed exploit code has been published for known weaknesses in the Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2). The MS-CHAP v2 protocol is widely used as an authentication method in Point-to-Point Tunneling Protocol (PPTP)-based VPNs. Microsoft is not currently aware of active attacks that use this exploit code or of customer impact at this time. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary..."
- http://support.microsoft.com/kb/2744850
Last Review: August 20, 2012 - Revision: 1.4

- http://h-online.com/-1672257
22 August 2012
___

Microsoft Security Advisory (2661254)
Update For Minimum Certificate Key Length
- https://blogs.technet.com/b/gladiato...edirected=true
14 Aug 2012 - "... an update was released that, once applied, will block RSA certificates with keys less than 1024 bits. The software update was released to the Download Center. The security advisory is located at:
http://technet.microsoft.com/security/advisory/2661254 .
The KB article is available at http://support.microsoft.com/kb/2661254 *.
The update is available now to allow organizations to assess the impact of this update and to reissue certificates with larger key sizes, if necessary, before the update is sent out through Windows Update. Previous blogs may have mentioned it being released to Windows Update this month. That is no longer the case. The update is planned to be sent out through Windows Update on October 9, 2012..."
* http://support.microsoft.com/kb/2661254
Last Review: August 21, 2012 - Revision: 2.1

[AplusWebMaster]

FYI...

- https://technet.microsoft.com/en-us/...letin/ms12-sep
September 06, 2012 - "This is an advance notification of security bulletins that Microsoft is intending to release on September 11, 2012...
(Total of -2-)

Bulletin 1 - Important - Elevation of Privilege - No restart required - Microsoft Developer Tools
Bulletin 2 - Important - Elevation of Privilege - No restart required - Microsoft Server Software
___

- https://blogs.technet.com/b/msrc/arc...edirected=true
6 Sep 2012 - "... Security Advisory 2661254* was initially made available in August via the Download Center and the Microsoft Update Catalog, with distribution through Windows Update planned for October 2012. To help ensure that all customers are prepared for the update, we are reiterating those announcements before releasing the requirement change with our monthly bulletins on Oct. 9... customers will want to take advantage of September’s quiet bulletin cycle to review their asset inventories – in particular, examining those systems and applications that have been tucked away to collect dust and cobwebs because they “still work” and have not had any cause for review for some time. For those who find they are using certificates with RSA key lengths of -less- than 1024 bits, those certificates will be required to be reissued with at least a 1024-bit key length. (1024 should, by the way, be considered a minimum length; the most up-to-date security practices recommend 2048 bits or even better.) We recommend that you evaluate your environments with the information provided in Security Advisory 2661254 and your organization is aware of and prepared to resolve any known issues prior to October. Some known issues that customers may encounter after applying this update may include:
• Error messages when browsing to web sites that have SSL certificates with keys that are less than 1024 bits
• Problems enrolling for certificates when a certificate request attempts to utilize a key that is less than 1024 bits
• Difficulties creating or consuming email (S/MIME) messages that utilize less than 1024 bit keys for signatures or encryption
• Difficulties installing Active X controls that were signed with less than 1024 bit signatures
• Difficulties installing applications that were signed with less than 1024 bit signatures (unless they were signed prior to Jan. 1, 2010, which will not be blocked by default)..."
* http://support.microsoft.com/kb/2661254
Last Review: August 21, 2012 - Revision: 2.1

.

[AplusWebMaster]

FYI...

- https://technet.microsoft.com/en-us/...letin/ms12-sep
Sep 11, 2012 - "This bulletin summary lists security bulletins released for September 2012...
(Total of -2-)

Microsoft Security Bulletin MS12-061 - Important
Vulnerability in Visual Studio Team Foundation Server Could Allow Elevation of Privilege (2719584)
- https://technet.microsoft.com/en-us/...letin/ms12-061
Important - Elevation of Privilege - No restart required - Microsoft Developer Tools

Microsoft Security Bulletin MS12-062 - Important
Vulnerability in System Center Configuration Manager Could Allow Elevation of Privilege (2741528)
- https://technet.microsoft.com/en-us/...letin/ms12-062
Important - Elevation of Privilege - No restart required - Microsoft Server Software

Bulletin Deployment priority
- https://blogs.technet.com/cfs-filesy...oyment-Pri.png

Severity and exploitability index
- https://blogs.technet.com/cfs-filesy...00_E-Index.png
___

- https://secunia.com/advisories/50463/ - MS12-061
- https://secunia.com/advisories/50497/ - MS12-062
___

Microsoft Security Advisory (2736233)
Update Rollup for ActiveX Kill Bits
- https://technet.microsoft.com/en-us/...visory/2736233
Sep 11, 2012 - "... This update sets the kill bits for the following third-party software:
Cisco Secure Desktop... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable...
Cisco Hostscan... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable...
Cisco AnyConnect Secure Mobility Client... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable..."
- http://support.microsoft.com/kb/2736233

Microsoft Security Advisory (2661254)
Update For Minimum Certificate Key Length
- https://technet.microsoft.com/en-us/...visory/2661254
V1.2 (September 11, 2012): Clarified that applications and services that use RSA keys for cryptography and call into the CertGetCertificateChain function could be impacted by this update. Examples of these applications and services include but are not limited to encrypted email, SSL/TLS encryption channels, signed applications, and private PKI environments.
- http://support.microsoft.com/kb/2661254
Last Review: September 12, 2012 - Revision: 3.0
___

MSRT
- http://support.microsoft.com/?kbid=890830
September 11, 2012 - Revision: 110.0
- http://www.microsoft.com/security/pc...-families.aspx
"... added in this release...
• Medfos ..."

- https://blogs.technet.com/b/mmpc/arc...edirected=true

Download:
- http://www.microsoft.com/download/en...ylang=en&id=16
File Name: Windows-KB890830-V4.12.exe - 16.1 MB
- https://www.microsoft.com/download/e...s.aspx?id=9905
x64 version of MSRT:
File Name: Windows-KB890830-x64-V4.12.exe - 16.7 MB
___

ISC Analysis
- https://isc.sans.edu/diary.html?storyid=14071
Last Updated: 2012-09-11

.

[AplusWebMaster]

FYI...

Microsoft Security Advisory (2757760)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
* http://technet.microsoft.com/security/advisory/2757760
17 Sep 2012 (see "Workarounds" [install EMET**, etc.] ) - "... To download EMET, visit the following Microsoft website:
https://www.microsoft.com/en-us/down....aspx?id=29851 ..."

** http://support.microsoft.com/kb/2458544

- https://blogs.technet.com/b/msrc/arc...edirected=true
17 Sep 2012 - "... we released Security Advisory 2757760* to address an issue that affects Internet Explorer 9 and earlier versions if a user views a website hosting malicious code. Internet Explorer 10 is not affected. We have received reports of only a small number of targeted attacks and are working to develop a security update to address this issue. In the meantime, customers using Internet Explorer are protected when they deploy the following workarounds and mitigations included in the advisory:
• Deploy the Enhanced Mitigation Experience Toolkit (EMET)
This will help prevent exploitation by providing mitigations to help protect against this issue and should not affect usability of websites.
• Set Internet and local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
• Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones
This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
Deploying EMET will help to prevent a malicious website from successfully exploiting the issue described in Security Advisory 2757760*. EMET in action is unobtrusive and should not affect customers’ Web browsing experience. We are monitoring the threat landscape very closely and if the situation changes, we will post updates here on the MSRC blog..."
___

- https://www.net-security.org/secworld.php?id=13614
18 Sep 2012 - "... The Rapid7 team got right on it and created a module exploiting the vulnerability for the Metasploit exploit toolkit during the weekend, and advised IE users to switch to other browsers such as Chrome or Firefox until Microsoft patches the flaw security update becomes available. Microsoft has reacted fast by issuing a security advisory yesterday, in which it confirms the existence of the flaw in Internet explorer 9 and all previous versions (IE10 is not affected), and offers instructions on steps the users can take to mitigate - but not yet remove - the threat:
• Deploy the Enhanced Mitigation Experience Toolkit (EMET) and configure it for Internet Explorer
• Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
• Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
These steps could bring additional problems to the users, such as being bombarded by a slew of security warnings, so until Microsoft releases a definitive patch for the hole, maybe it would be easier for IE users to take Rapid7's advice and switch to another browser for the time being."

[AplusWebMaster]

FYI...

Microsoft Security Advisory (2757760)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
- https://technet.microsoft.com/en-us/...visory/2757760
V1.1 (Sep 18, 2012): Assigned Common Vulnerability and Exposure number CVE-2012-4969 to the issue. Also -corrected- instructions in the EMET workaround.
V1.2 (Sep 19, 2012): Added link to Microsoft Fix it solution, "Prevent Memory Corruption via ExecCommand in Internet Explorer," that prevents exploitation of this issue.

- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-4969 - 9.3 (HIGH)
"... function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012..."

- https://blogs.technet.com/b/msrc/arc...edirected=true
18 Sep 2012 - "We will release a Fix it in the next few days to address an issue in Internet Explorer... It will not affect your ability to browse the Web, and it will provide full protection against this issue until an update is available. It won’t require a reboot of your computer. This Fix it will be available for everyone to download and install within the next few days..."

[AplusWebMaster]

FYI...

IE Fix it available - Security Update scheduled for Friday
- https://blogs.technet.com/b/msrc/arc...edirected=true
19 Sep 2012 - "... today we have released a Fix it* that is available to address that issue. This is an easy, one-click solution that will help protect your computer right away. It will not affect your ability to browse the web, and it does not require a reboot of your computer. Then, on this Friday, Sept. 21, we will release a cumulative update for Internet Explorer through Windows Update and our other standard distribution channels. We recommend that you install this update as soon as it is available... This will not only reinforce the issue that the Fix It addressed, but cover other issues as well. Today’s Advance Notification Service** (ANS) provides additional details about the update we are releasing on Friday - MS12-063. We are planning to release this bulletin as close to 10 a.m. PDT as possible. This cumulative update for Internet Explorer has an aggregate severity rating of Critical. It addresses the publicly disclosed issue described in Security Advisory 2757760 as well as four other Critical-class remote code execution issues..."
* http://support.microsoft.com/kb/2757760#FixItForMe
Last Review: September 20, 2012 - Revision: 2.0

** http://technet.microsoft.com/security/bulletin/ms12-sep
Sep 19, 2012 - Version: 2.0
Bulletin 1 - Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

[AplusWebMaster]

FYI...

> https://technet.microsoft.com/en-us/...letin/ms12-sep
V2.0 (Sep 21, 2012): Added Microsoft Security Bulletin MS12-063, Cumulative Security Update for Internet Explorer (2744842)... out-of-band security bulletin.

Microsoft Security Bulletin MS12-063 - Critical
Cumulative Security Update for Internet Explorer (2744842)
- https://technet.microsoft.com/en-us/...letin/ms12-063
Sep 21, 2012 - Internet Explorer 6, 7, 8, 9.
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-1529 - 9.3 (HIGH)
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2546 - 9.3 (HIGH)
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2548 - 9.3 (HIGH)
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2557 - 9.3 (HIGH)
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-4969 - 9.3 (HIGH)

> https://update.microsoft.com/

[AplusWebMaster]

FYI...

Microsoft Security Advisory (2757760)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
- https://technet.microsoft.com/en-us/...visory/2757760
V2.0 (Sep 21, 2012): Advisory updated to reflect publication of security bulletin.
"... We have issued MS12-063* to address this issue..."
* https://technet.microsoft.com/en-us/...letin/ms12-063
Sep 21, 2012 - "... rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows..."

- https://blogs.technet.com/b/msrc/arc...edirected=true
21 Sep 2012

- http://atlas.arbor.net/briefs/index#1229731326
Severity: Extreme Severity
Sep 21, 2012
MS12-063 patches the recent 0day security hole in Internet Explorer along with other security holes.
Analysis: The exploit for one of the now-patched security holes was first found and reported last week and was apparently used in targeted attacks. One of the actions of at least one group of attackers was the installation of the Poison Ivy Remote Access Trojan (RAT). The exploit for this issue was soon revealed to the public and a Metasploit module was developed, allowing anyone to gain access to the exploit code for any purpose...

> https://update.microsoft.com/
___

Microsoft Security Advisory (2755801)
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10
- https://technet.microsoft.com/en-us/...visory/2755801
Sep 21, 2012 - "... availability of an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10... The update addresses the vulnerabilities described in Adobe security bulletins APSB12-18 and APSB12-19. As of the release of this update, CVE-2012-1535* is known to be under active attack. For more information about this update, including download links, see Microsoft Knowledge Base Article 2755399**... Customers with Windows 8 Release Preview and Windows Server 2012 Release Candidate are encouraged to apply the update to their systems. The update is only available on Windows Update**..."
** http://go.microsoft.com/fwlink/?LinkId=21130

* http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-1535 - 9.3 (HIGH)
Last revised: 08/15/2012
** http://support.microsoft.com/kb/2755399
Sep 21, 2012
- https://blogs.technet.com/b/msrc/arc...edirected=true
21 Sep 2012

- http://atlas.arbor.net/briefs/index#1045103976
Severity: Elevated Severity
Sep 21, 2012
Microsoft releases a security update to Flash player.
Analysis: This patch resolves security issues patched by Adobe in August 2012 for Internet Explorer 10 on Windows 8. This includes the following CVE's: CVE-2012-1535, CVE-2012-4163, CVE-2012-4164, CVE-2012-4165, CVE-2012-4166, CVE-2012-4167, CVE-2012-4168, CVE-2012-4171. Attacks on the CVE-2012-1535 vulnerability are actively underway...