Page 3 of 47 FirstFirst 123456713 ... LastLast
Results 21 to 30 of 467

Thread: Microsoft Alerts

  1. #21
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS Security Advisories - 2012.08.14 ...

    FYI...

    Microsoft Security Advisory (2737111)
    Vulnerabilities in Microsoft Exchange and FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution
    - https://technet.microsoft.com/en-us/...visory/2737111
    • V2.0 (August 14, 2012): Advisory updated to reflect publication of security bulletin for Microsoft Exchange.
    ... MS12-058* addresses this issue for Microsoft Exchange.
    * https://technet.microsoft.com/en-us/...letin/ms12-058

    Microsoft Security Advisory (2661254)
    Update For Minimum Certificate Key Length
    - https://technet.microsoft.com/en-us/...visory/2661254
    August 14, 2012 - Ref:
    > http://support.microsoft.com/kb/2661254
    ... Update for minimum certificate key length
    August 14, 2012 - Revision: 1.6

    >> http://forums.spybot.info/showpost.p...1&postcount=42

    Last edited by AplusWebMaster; 2012-08-16 at 05:15.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #22
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS12-043 re-released ...

    FYI...

    Microsoft Security Bulletin MS12-043 - Critical
    Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)
    - https://technet.microsoft.com/en-us/...letin/ms12-043
    V2.0 (August 14, 2012): Bulletin re-released to offer the security updates for Microsoft XML Core Services 5.0 that were unavailable at the time of initial release. Customers running Microsoft XML Core Services 5.0 should apply the KB2687324, KB2596856, or KB2596679 update to be protected from the vulnerability described in this bulletin. Customers who have already successfully installed the updates originally offered on July 10, 2012 for Microsoft XML Core Services 3.0, Microsoft XML Core Services 4.0, and Microsoft XML Core Services 6.0 do not need to take any action. See the Update FAQ for details...

    - http://support.microsoft.com/kb/2687324
    Last Review: August 14, 2012 - Revision: 1.9

    - http://support.microsoft.com/kb/2596856
    Last Review: August 14, 2012 - Revision: 1.0

    - http://support.microsoft.com/kb/2596679
    Last Review: August 14, 2012 - Revision: 1.2

    Last edited by AplusWebMaster; 2012-08-20 at 15:30.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #23
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS Security Advisory (2743314)

    FYI...

    Microsoft Security Advisory (2743314)
    Unencapsulated MS-CHAP v2 Authentication Could Allow Information Disclosure
    - https://technet.microsoft.com/en-us/...visory/2743314
    August 20, 2012 - "Microsoft is aware that detailed exploit code has been published for known weaknesses in the Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2). The MS-CHAP v2 protocol is widely used as an authentication method in Point-to-Point Tunneling Protocol (PPTP)-based VPNs. Microsoft is not currently aware of active attacks that use this exploit code or of customer impact at this time. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary..."
    - http://support.microsoft.com/kb/2744850
    Last Review: August 20, 2012 - Revision: 1.4

    - http://h-online.com/-1672257
    22 August 2012
    ___

    Microsoft Security Advisory (2661254)
    Update For Minimum Certificate Key Length
    - https://blogs.technet.com/b/gladiato...edirected=true
    14 Aug 2012 - "... an update was released that, once applied, will block RSA certificates with keys less than 1024 bits. The software update was released to the Download Center. The security advisory is located at:
    http://technet.microsoft.com/security/advisory/2661254 .
    The KB article is available at http://support.microsoft.com/kb/2661254 *.
    The update is available now to allow organizations to assess the impact of this update and to reissue certificates with larger key sizes, if necessary, before the update is sent out through Windows Update. Previous blogs may have mentioned it being released to Windows Update this month. That is no longer the case. The update is planned to be sent out through Windows Update on October 9, 2012..."
    * http://support.microsoft.com/kb/2661254
    Last Review: August 21, 2012 - Revision: 2.1

    Last edited by AplusWebMaster; 2012-08-22 at 17:09.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #24
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Post MS Bulletin Advance Notification - September 2012

    FYI...

    - https://technet.microsoft.com/en-us/...letin/ms12-sep
    September 06, 2012 - "This is an advance notification of security bulletins that Microsoft is intending to release on September 11, 2012...
    (Total of -2-)

    Bulletin 1 - Important - Elevation of Privilege - No restart required - Microsoft Developer Tools
    Bulletin 2 - Important - Elevation of Privilege - No restart required - Microsoft Server Software
    ___

    - https://blogs.technet.com/b/msrc/arc...edirected=true
    6 Sep 2012 - "... Security Advisory 2661254* was initially made available in August via the Download Center and the Microsoft Update Catalog, with distribution through Windows Update planned for October 2012. To help ensure that all customers are prepared for the update, we are reiterating those announcements before releasing the requirement change with our monthly bulletins on Oct. 9... customers will want to take advantage of September’s quiet bulletin cycle to review their asset inventories – in particular, examining those systems and applications that have been tucked away to collect dust and cobwebs because they “still work” and have not had any cause for review for some time. For those who find they are using certificates with RSA key lengths of -less- than 1024 bits, those certificates will be required to be reissued with at least a 1024-bit key length. (1024 should, by the way, be considered a minimum length; the most up-to-date security practices recommend 2048 bits or even better.) We recommend that you evaluate your environments with the information provided in Security Advisory 2661254 and your organization is aware of and prepared to resolve any known issues prior to October. Some known issues that customers may encounter after applying this update may include:
    • Error messages when browsing to web sites that have SSL certificates with keys that are less than 1024 bits
    • Problems enrolling for certificates when a certificate request attempts to utilize a key that is less than 1024 bits
    • Difficulties creating or consuming email (S/MIME) messages that utilize less than 1024 bit keys for signatures or encryption
    • Difficulties installing Active X controls that were signed with less than 1024 bit signatures
    • Difficulties installing applications that were signed with less than 1024 bit signatures (unless they were signed prior to Jan. 1, 2010, which will not be blocked by default)..."
    * http://support.microsoft.com/kb/2661254
    Last Review: August 21, 2012 - Revision: 2.1

    .
    Last edited by AplusWebMaster; 2012-09-07 at 15:44.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #25
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS Security Bulletin Summary - September 2012

    FYI...

    - https://technet.microsoft.com/en-us/...letin/ms12-sep
    Sep 11, 2012 - "This bulletin summary lists security bulletins released for September 2012...
    (Total of -2-)

    Microsoft Security Bulletin MS12-061 - Important
    Vulnerability in Visual Studio Team Foundation Server Could Allow Elevation of Privilege (2719584)
    - https://technet.microsoft.com/en-us/...letin/ms12-061
    Important - Elevation of Privilege - No restart required - Microsoft Developer Tools

    Microsoft Security Bulletin MS12-062 - Important
    Vulnerability in System Center Configuration Manager Could Allow Elevation of Privilege (2741528)
    - https://technet.microsoft.com/en-us/...letin/ms12-062
    Important - Elevation of Privilege - No restart required - Microsoft Server Software

    Bulletin Deployment priority
    - https://blogs.technet.com/cfs-filesy...oyment-Pri.png

    Severity and exploitability index
    - https://blogs.technet.com/cfs-filesy...00_E-Index.png
    ___

    - https://secunia.com/advisories/50463/ - MS12-061
    - https://secunia.com/advisories/50497/ - MS12-062
    ___

    Microsoft Security Advisory (2736233)
    Update Rollup for ActiveX Kill Bits
    - https://technet.microsoft.com/en-us/...visory/2736233
    Sep 11, 2012 - "... This update sets the kill bits for the following third-party software:
    Cisco Secure Desktop... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable...
    Cisco Hostscan... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable...
    Cisco AnyConnect Secure Mobility Client... relates to a request by Cisco to set a kill bit for an ActiveX control that is vulnerable..."
    - http://support.microsoft.com/kb/2736233

    Microsoft Security Advisory (2661254)
    Update For Minimum Certificate Key Length
    - https://technet.microsoft.com/en-us/...visory/2661254
    V1.2 (September 11, 2012): Clarified that applications and services that use RSA keys for cryptography and call into the CertGetCertificateChain function could be impacted by this update. Examples of these applications and services include but are not limited to encrypted email, SSL/TLS encryption channels, signed applications, and private PKI environments.
    - http://support.microsoft.com/kb/2661254
    Last Review: September 12, 2012 - Revision: 3.0
    ___

    MSRT
    - http://support.microsoft.com/?kbid=890830
    September 11, 2012 - Revision: 110.0
    - http://www.microsoft.com/security/pc...-families.aspx
    "... added in this release...
    • Medfos ..."

    - https://blogs.technet.com/b/mmpc/arc...edirected=true

    Download:
    - http://www.microsoft.com/download/en...ylang=en&id=16
    File Name: Windows-KB890830-V4.12.exe - 16.1 MB
    - https://www.microsoft.com/download/e...s.aspx?id=9905
    x64 version of MSRT:
    File Name: Windows-KB890830-x64-V4.12.exe - 16.7 MB
    ___

    ISC Analysis
    - https://isc.sans.edu/diary.html?storyid=14071
    Last Updated: 2012-09-11

    .
    Last edited by AplusWebMaster; 2012-09-13 at 16:37.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #26
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation Microsoft Security Advisory 2757760 - IE

    FYI...

    Microsoft Security Advisory (2757760)
    Vulnerability in Internet Explorer Could Allow Remote Code Execution
    * http://technet.microsoft.com/security/advisory/2757760
    17 Sep 2012 (see "Workarounds" [install EMET**, etc.] ) - "... To download EMET, visit the following Microsoft website:
    https://www.microsoft.com/en-us/down....aspx?id=29851 ..."

    ** http://support.microsoft.com/kb/2458544

    - https://blogs.technet.com/b/msrc/arc...edirected=true
    17 Sep 2012 - "... we released Security Advisory 2757760* to address an issue that affects Internet Explorer 9 and earlier versions if a user views a website hosting malicious code. Internet Explorer 10 is not affected. We have received reports of only a small number of targeted attacks and are working to develop a security update to address this issue. In the meantime, customers using Internet Explorer are protected when they deploy the following workarounds and mitigations included in the advisory:
    • Deploy the Enhanced Mitigation Experience Toolkit (EMET)
    This will help prevent exploitation by providing mitigations to help protect against this issue and should not affect usability of websites.
    • Set Internet and local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
    This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
    • Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones
    This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.
    Deploying EMET will help to prevent a malicious website from successfully exploiting the issue described in Security Advisory 2757760*. EMET in action is unobtrusive and should not affect customers’ Web browsing experience. We are monitoring the threat landscape very closely and if the situation changes, we will post updates here on the MSRC blog..."
    ___

    - https://www.net-security.org/secworld.php?id=13614
    18 Sep 2012 - "... The Rapid7 team got right on it and created a module exploiting the vulnerability for the Metasploit exploit toolkit during the weekend, and advised IE users to switch to other browsers such as Chrome or Firefox until Microsoft patches the flaw security update becomes available. Microsoft has reacted fast by issuing a security advisory yesterday, in which it confirms the existence of the flaw in Internet explorer 9 and all previous versions (IE10 is not affected), and offers instructions on steps the users can take to mitigate - but not yet remove - the threat:
    • Deploy the Enhanced Mitigation Experience Toolkit (EMET) and configure it for Internet Explorer
    • Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
    • Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
    These steps could bring additional problems to the users, such as being bombarded by a slew of security warnings, so until Microsoft releases a definitive patch for the hole, maybe it would be easier for IE users to take Rapid7's advice and switch to another browser for the time being."

    Last edited by AplusWebMaster; 2012-09-19 at 03:59.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #27
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS Security Advisory 2757760 V1.1

    FYI...

    Microsoft Security Advisory (2757760)
    Vulnerability in Internet Explorer Could Allow Remote Code Execution
    - https://technet.microsoft.com/en-us/...visory/2757760
    V1.1 (Sep 18, 2012): Assigned Common Vulnerability and Exposure number CVE-2012-4969 to the issue. Also -corrected- instructions in the EMET workaround.
    V1.2 (Sep 19, 2012): Added link to Microsoft Fix it solution, "Prevent Memory Corruption via ExecCommand in Internet Explorer," that prevents exploitation of this issue.

    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-4969 - 9.3 (HIGH)
    "... function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012..."

    - https://blogs.technet.com/b/msrc/arc...edirected=true
    18 Sep 2012 - "We will release a Fix it in the next few days to address an issue in Internet Explorer... It will not affect your ability to browse the Web, and it will provide full protection against this issue until an update is available. It won’t require a reboot of your computer. This Fix it will be available for everyone to download and install within the next few days..."

    Last edited by AplusWebMaster; 2012-09-20 at 05:31.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #28
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation IE Fix it available - Security Update scheduled for Friday

    FYI...

    IE Fix it available - Security Update scheduled for Friday
    - https://blogs.technet.com/b/msrc/arc...edirected=true
    19 Sep 2012 - "... today we have released a Fix it* that is available to address that issue. This is an easy, one-click solution that will help protect your computer right away. It will not affect your ability to browse the web, and it does not require a reboot of your computer. Then, on this Friday, Sept. 21, we will release a cumulative update for Internet Explorer through Windows Update and our other standard distribution channels. We recommend that you install this update as soon as it is available... This will not only reinforce the issue that the Fix It addressed, but cover other issues as well. Today’s Advance Notification Service** (ANS) provides additional details about the update we are releasing on Friday - MS12-063. We are planning to release this bulletin as close to 10 a.m. PDT as possible. This cumulative update for Internet Explorer has an aggregate severity rating of Critical. It addresses the publicly disclosed issue described in Security Advisory 2757760 as well as four other Critical-class remote code execution issues..."
    * http://support.microsoft.com/kb/2757760#FixItForMe
    Last Review: September 20, 2012 - Revision: 2.0

    ** http://technet.microsoft.com/security/bulletin/ms12-sep
    Sep 19, 2012 - Version: 2.0
    Bulletin 1 - Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

    Last edited by AplusWebMaster; 2012-09-20 at 18:34.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #29
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS12-063 released - Critical - IE

    FYI...

    > https://technet.microsoft.com/en-us/...letin/ms12-sep
    V2.0 (Sep 21, 2012): Added Microsoft Security Bulletin MS12-063, Cumulative Security Update for Internet Explorer (2744842)... out-of-band security bulletin.

    Microsoft Security Bulletin MS12-063 - Critical
    Cumulative Security Update for Internet Explorer (2744842)
    - https://technet.microsoft.com/en-us/...letin/ms12-063
    Sep 21, 2012 - Internet Explorer 6, 7, 8, 9.
    Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-1529 - 9.3 (HIGH)
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2546 - 9.3 (HIGH)
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2548 - 9.3 (HIGH)
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-2557 - 9.3 (HIGH)
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-4969 - 9.3 (HIGH)

    > https://update.microsoft.com/

    Last edited by AplusWebMaster; 2012-09-25 at 00:41.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #30
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Exclamation MS12-063 released - IE out-of-band ...

    FYI...

    Microsoft Security Advisory (2757760)
    Vulnerability in Internet Explorer Could Allow Remote Code Execution
    - https://technet.microsoft.com/en-us/...visory/2757760
    V2.0 (Sep 21, 2012): Advisory updated to reflect publication of security bulletin.
    "... We have issued MS12-063* to address this issue..."
    * https://technet.microsoft.com/en-us/...letin/ms12-063
    Sep 21, 2012 - "... rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows..."

    - https://blogs.technet.com/b/msrc/arc...edirected=true
    21 Sep 2012

    - http://atlas.arbor.net/briefs/index#1229731326
    Severity: Extreme Severity
    Sep 21, 2012
    MS12-063 patches the recent 0day security hole in Internet Explorer along with other security holes.
    Analysis: The exploit for one of the now-patched security holes was first found and reported last week and was apparently used in targeted attacks. One of the actions of at least one group of attackers was the installation of the Poison Ivy Remote Access Trojan (RAT). The exploit for this issue was soon revealed to the public and a Metasploit module was developed, allowing anyone to gain access to the exploit code for any purpose...

    > https://update.microsoft.com/
    ___

    Microsoft Security Advisory (2755801)
    Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10
    - https://technet.microsoft.com/en-us/...visory/2755801
    Sep 21, 2012 - "... availability of an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10... The update addresses the vulnerabilities described in Adobe security bulletins APSB12-18 and APSB12-19. As of the release of this update, CVE-2012-1535* is known to be under active attack. For more information about this update, including download links, see Microsoft Knowledge Base Article 2755399**... Customers with Windows 8 Release Preview and Windows Server 2012 Release Candidate are encouraged to apply the update to their systems. The update is only available on Windows Update**..."
    ** http://go.microsoft.com/fwlink/?LinkId=21130

    * http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-1535 - 9.3 (HIGH)
    Last revised: 08/15/2012
    ** http://support.microsoft.com/kb/2755399
    Sep 21, 2012
    - https://blogs.technet.com/b/msrc/arc...edirected=true
    21 Sep 2012

    - http://atlas.arbor.net/briefs/index#1045103976
    Severity: Elevated Severity
    Sep 21, 2012
    Microsoft releases a security update to Flash player.
    Analysis: This patch resolves security issues patched by Adobe in August 2012 for Internet Explorer 10 on Windows 8. This includes the following CVE's: CVE-2012-1535, CVE-2012-4163, CVE-2012-4164, CVE-2012-4165, CVE-2012-4166, CVE-2012-4167, CVE-2012-4168, CVE-2012-4171. Attacks on the CVE-2012-1535 vulnerability are actively underway...

    Last edited by AplusWebMaster; 2012-09-23 at 04:20.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •