Today, as part of Update Tuesday, we released eight security updates – one rated Critical and seven rated Important in severity, to address eight unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows.
We encourage you to apply all of these updates. For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary webpage. If you are not familiar with how we calculate XI, a full description can be found here.
Today, as part of Update Tuesday, we released eight security updates – one rated Critical and seven rated Important in severity, to address eight unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows.
We encourage you to apply all of these updates. For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary webpage. If you are not familiar with how we calculate XI, a full description can be found here.
Today, as part of Update Tuesday, we released seven security updates – three rated Critical and four rated Important in severity, to address 24 unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Internet Explorer (IE), Office and Exchange.
We encourage you to apply all of these updates. For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary webpage. If you are not familiar with how we calculate XI, a full description can be found here.
Today, as part of Update Tuesday, we released seven security updates – three rated Critical and four rated Important in severity, to address 24 unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Internet Explorer (IE), Office and Exchange.
We encourage you to apply all of these updates. For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary webpage. If you are not familiar with how we calculate XI, a full description can be found here.
Today, we released an out-of-band security update to address a vulnerability in Kerberos which could allow Elevation of Privilege. This update is for all supported versions of Windows Server and includes a defense-in-depth update for all supported versions of Windows.
We strongly encourage customers to apply this update as soon as possible by following the directions in Security Bulletin MS14-068.
Tracey Pretorius, Director Response Communications
Today, we released an out-of-band security update to address a vulnerability in Kerberos which could allow Elevation of Privilege. This update is for all supported versions of Windows Server and includes a defense-in-depth update for all supported versions of Windows.
We strongly encourage customers to apply this update as soon as possible by following the directions in Security Bulletin MS14-068.
Tracey Pretorius, Director Response Communications
Today, as part of Update Tuesday, we released eight security updates – three rated Critical and five rated Important – to address 24 Common Vulnerabilities & Exposures (CVEs) in Windows, Office, .NET Framework, .ASP.NET, and Internet Explorer (IE). We encourage you to apply all of these updates, but for those who need to prioritize deployment planning, we recommend focusing on the Critical updates first.
Here’s an overview slide and video of the security updates released today:
For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary Web page. If you are not familiar with how we calculate XI, a full description is found here.
Today, Microsoft also announced upcoming updates to the out-of-date ActiveX control blocking feature. Beginning November 11, 2014, the out-of-date ActiveX control blocking feature will automatically be expanded to block outdated versions of Silverlight, in addition to outdated versions of Java. It is also being expanded to support Internet Explorer 9 on Windows Vista SP2 and Windows Server 2008 SP2. For more information on this, please visit the IEBlog.
Watch our bulletin webcast tomorrow, Wednesday, October 15, 2014, at 11 a.m. PDT.
For all the latest information, you can follow the MSRC team on Twitter at @MSFTSecResponse.
Today, as part of Update Tuesday, we released eight security updates – three rated Critical and five rated Important – to address 24 Common Vulnerabilities & Exposures (CVEs) in Windows, Office, .NET Framework, .ASP.NET, and Internet Explorer (IE). We encourage you to apply all of these updates, but for those who need to prioritize deployment planning, we recommend focusing on the Critical updates first.
Here’s an overview slide and video of the security updates released today:
For more information about this month’s security updates, including the detailed view of the Exploit Index (XI) broken down by each CVE, visit the Microsoft Bulletin Summary Web page. If you are not familiar with how we calculate XI, a full description is found here.
Today, Microsoft also announced upcoming updates to the out-of-date ActiveX control blocking feature. Beginning November 11, 2014, the out-of-date ActiveX control blocking feature will automatically be expanded to block outdated versions of Silverlight, in addition to outdated versions of Java. It is also being expanded to support Internet Explorer 9 on Windows Vista SP2 and Windows Server 2008 SP2. For more information on this, please visit the IEBlog.
Watch our bulletin webcast tomorrow, Wednesday, October 15, 2014, at 11 a.m. PDT.
For all the latest information, you can follow the MSRC team on Twitter at @MSFTSecResponse.
Today, as a part of our regular Update Tuesday process, we released four security bulletins – one rated Critical and three rated Important in severity – to address 42 Common Vulnerabilities & Exposures (CVEs) in Microsoft Windows, Internet Explorer, .NET Framework, and Lync Server. We encourage you to apply all of these updates, but for those who need to prioritize, we recommend focusing on the Critical update first.
Below is a graphical overview of this release and a brief video summarizing the updates released today:
The top deployment priority for our customers this month is the update for Internet Explorer, which addresses 37 CVEs. In case you missed it, the August update for Internet Explorer also included new functionality to block out-of-date ActiveX controls. This functionality will be enabled with today’s update. You can see what these notifications will look like by reviewing this TechNet article. Administrative Templates are also available for those who wish to manage these settings through Group Policy.
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by each CVE, visit the Microsoft Bulletin Summary Web page. If you are not familiar with how we calculate the Exploitability Index (XI), a full description is found here.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, September 10, 2014, at 11 a.m. PDT.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
Today, as a part of our regular Update Tuesday process, we released four security bulletins – one rated Critical and three rated Important in severity – to address 42 Common Vulnerabilities & Exposures (CVEs) in Microsoft Windows, Internet Explorer, .NET Framework, and Lync Server. We encourage you to apply all of these updates, but for those who need to prioritize, we recommend focusing on the Critical update first.
Below is a graphical overview of this release and a brief video summarizing the updates released today:
The top deployment priority for our customers this month is the update for Internet Explorer, which addresses 37 CVEs. In case you missed it, the August update for Internet Explorer also included new functionality to block out-of-date ActiveX controls. This functionality will be enabled with today’s update. You can see what these notifications will look like by reviewing this TechNet article. Administrative Templates are also available for those who wish to manage these settings through Group Policy.
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by each CVE, visit the Microsoft Bulletin Summary Web page. If you are not familiar with how we calculate the Exploitability Index (XI), a full description is found here.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, September 10, 2014, at 11 a.m. PDT.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
Many around the globe have been following the 2014 FIFA World Cup Brazil™ closely. Regardless of which country you are supporting, many folks have been impressed by the defensive display put on by keeper Tim Howard in a loss against Belgium. It was a great performance highlighting a strong defense – always a good thing to have, be it on the pitch or on your system.
This month’s release includes six new security bulletins, addressing 29 Common Vulnerability and Exposures (CVEs) in Microsoft Windows and Internet Explorer. Two of these security bulletins are rated Critical, three are rated Important, and one rated Moderate in severity. As always, we encourage you to apply all of the updates, but for those who prioritize, we recommend the Windows Journal and Internet Explorer (IE) updates be on the top of your list.
If you are looking for additional resources to help you prioritize, take a look at our recently released myBulletins security bulletins customization free online service. myBulletins enables you to quickly find security bulletins using advanced search and filtering options. The service also provides a dynamic list in a customizable dashboard that can be edited at any time, as well as downloaded to a Microsoft Excel report. Give it a try, and let us know what you think by using the site feedback link.
Here’s an overview of all of the updates released today:
Click to enlarge
*Bulletins in each deployment priority are listed in numerical order by bulletin number
The security bulletin for Windows Journal addresses one privately reported CVE that could allow an attacker to execute code on your system if you open a malicious Windows Journal file. It’s worth noting that Windows Server versions do not have Windows Journal installed by default. That’s by design. You are always at less risk when you have fewer applications installed, so server systems ship with many optional components disabled. If you haven’t reviewed the applications installed on your server recently, now is a good time to do so. Reducing the attack surface will have a positive impact on the overall security of the server.
The ongoing diligent work from our Internet Explorer team continues this month, with the security bulletin for Internet Explorer addressing a total of 24 CVEs. The most critical of these could allow remote code execution if a user views a webpage specially crafted by a cybercriminal. Similar to last month, we have not seen any active attacks attempting to exploit any of the CVEs addressed by this security bulletin – or any of the other issues we addressed this month. Addressing these items before there is any customer impact from attacks remains our goal with security bulletins.
To ensure you have our latest protections while browsing the Internet, you should really upgrade to the latest version of Internet Explorer. For Windows 7 and Windows 8.1, that means Internet Explorer 11 – the most modern, secure browser we have built. Internet Explorer 11 has advanced security features like Enhanced Protection Mode (EPM) and SmartScreen Filter, support for modern web standards, and Enterprise Mode for rendering legacy web apps. Internet Explorer 11 is much more secure than our older versions, which is why we encourage customers to upgrade.
We also have three advisories to address today. The first is a revision to the Update to Improve Credentials Protection and Management. This new package changes the default behavior for Restricted Admin mode on Windows 8.1 and Windows Server 2012 R2. This advisory deals with different strategies for combating credential theft, which is a hot topic today. Patrick Jungles (lead author) and team have a new whitepaper discussing ways to defend against pass-the-hash style attacks, and there is a new web resource that covers various techniques and tactics to help prevent different types of credential theft attacks. Implementing these tactics before they are needed is another way to positively impact the overall security posture in an enterprise.
The Update for Disabling RC4 in .NET TLS has been revised as well. This update was revised to announce a Microsoft Update Catalog detection change for the updates requiring installation of the 2868725 prerequisite update. If you have already successfully installed this update, then you don’t need to take any further action.
Finally, we are revising Security Advisory 2755801 with the latest update for Adobe Flash Player in Internet Explorer. The update addresses the vulnerabilities described in Adobe Security bulletin APSB14-17. For more information about this update, including download links, see Microsoft Knowledge Base Article 2974008.
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by CVE, visit the Microsoft Bulletin Summary Web page. Watch the bulletin overview video below for a brief summary of today's releases.
Jonathan Ness and I will host the monthly security bulletin webcast, scheduled for Wednesday, July 9, 2014, at 11 a.m. PDT. There’s no longer a need to register before this event to attend. You can find details on how to view the webcast and get a calendar reminder here. I invite you to tune in to learn more about this month’s security bulletins.
I look forward to hearing any questions about this month’s release during our webcast tomorrow.
For all the latest information, you can also follow us at @MSFTSecResponse.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
Today, we released eight security bulletins – two rated Critical and six rated Important – to address 13 Common Vulnerability & Exposures (CVEs) in .NET Framework, Office, SharePoint, Internet Explorer, and Windows. We encourage you to apply all of these updates, but for those who need to prioritize their deployment planning, we recommend focusing on MS14-024, MS14-025 and MS14-029.
We also have some new security advisories releasing today. Security Advisory 2871997 provides an update for Windows 8 and Windows Server 2012 that enhances credential protection and domain authentication controls to reduce credential theft by making specific improvements. These features are currently available in Windows 8.1 and Windows Server 2012 R2, and we are making them available for other platforms.
The .NET Framework update provided by Security Advisory 2960358 disables Rivest Cipher 4 (RC4) in Transport Layer Security (TLS). This is similar to what we did with Security Advisory 2868725 back in November, 2013. The only difference here is this month’s advisory is specific to the .NET Framework.
The last of the new advisories is Security Advisory 2962824. This update revokes the digital signature for a specific Unified Extensible Firmware Interface (UEFI) module. Although we are not currently aware of any customer impact, we’re taking this step out of an abundance of caution as a part of our ongoing efforts to provide the best customer protections available. If you are not running a system that supports UEFI Secure Boot or you have it disabled, there is no risk, and no action for you to take.
Finally, we are revising Security Advisory 2755801 with the latest update for Adobe Flash Player in Internet Explorer. The update addresses the vulnerabilities described in Adobe Security bulletin APSB14-14. For more information about this update, including download links, see Microsoft Knowledge Base Article 2957151.
For those wondering, Windows XP will not be receiving any security updates today. For some time we have been recommending customers move to a modern operating system like Windows 7 or Windows 8.1 to help stay safe, and now is a great time to make that move. For more information, see the Windows Experience Blog.
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by each CVE, visit the Microsoft Bulletin Summary Web page. If you are not familiar with how we calculate the Exploit Index (XI), a full description is found here.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, May 14, 2014, at 11 a.m. PDT. I invite you to register here and tune in to learn more about this month’s security bulletins and advisories.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
At approximately 10 a.m. PDT, we will release an out-of-band security update to address the issue affecting Internet Explorer (IE) that was first discussed in Security Advisory 2963983. This update is fully tested and ready for release for all affected versions of the browser.
The majority of customers have automatic updates enabled and will not need to take any action because protections will be downloaded and installed automatically. If you’re unsure if you have automatic updates, or you haven’t enabled Automatic Update, now is the time.
For those manually updating, we strongly encourage you to apply this update as quickly as possible following the directions in the released security bulletin.
We have made the decision to issue a security update for Windows XP users. Windows XP is no longer supported by Microsoft, and we continue to encourage customers to migrate to a modern operating system, such as Windows 7 or 8.1. Additionally, customers are encouraged to upgrade to the latest version of Internet Explorer, IE 11.
Please join us tomorrow at 11 a.m. PDT for a webcast where we will present information on the bulletin.
More information about the upcoming security bulletin can be found at Microsoft’s Advance Notification Service (ANS) webpage.You can also stay apprised of the MSRC team’s recent activities by following us on Twitter at @MSFTSecResponse.
Thank you, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
T. S. Elliot once said, “What we call the beginning is often the end. And to make an end is to make a beginning. The end is where we start from.” So as we put one season to bed, let’s start another by looking at the April security updates. Today, we release four bulletins to address 11 CVEs in Microsoft Windows, Internet Explorer and Microsoft Office. The update for Microsoft Word addresses the issues described in Microsoft Security Advisory 2953095. For those who prioritize, we recommend this bulletin as well as the update for Internet Explorer be on the top of your list.
We would be remiss if we did not mention another end; the end of support for Windows XP and Office 2003. The updates provided by MS14-018 and MS14-019 will be the final security updates for Windows XP; MS14-017 and MS14-020 are the final update for Office 2003. For those who haven’t migrated yet, I recommend visiting the Microsoft Security Blog, where my colleague Tim Rains provides guidance for consumers and small businesses who may have questions about how end of support affects them. Enterprise administrators will also find this a worthwhile read.
Here’s an overview of all the updates released this month:
Click to enlarge
Our top priorities for this month are MS14-018 and MS14-017, which address issues in Internet Explorer and Microsoft Word respectively.
This security update resolves six privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. While the issues addressed by this bulletin are very straightforward, I wanted to specifically call your attention to the updates for Internet Explorer 11 on Windows 8.1 and Windows Server 2012 R2. For these platforms, the update is not cumulative – it only addresses this issues described in this bulletin. You also have the option of installing KB2919355, which is a cumulative update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2. In addition to previous updates for these operating systems, it includes enhancements such as improved Internet Explorer 11 compatibility for enterprise applications, usability improvements, extended mobile device management, and improved hardware support. Additionally, for Windows Server 2012 R2, it includes support for clustering configurations for hosters. For more information about this update, see Microsoft Knowledge Base Article 2919355.
Similarly, customers running Internet Explorer 11 on Windows 7 and Windows Server 2008 R2 also can choose a cumulative update: KB2929437. In addition to previous updates for Internet Explorer 11 on these operating systems, it includes enhancements such as improved Internet Explorer 11 compatibility for enterprise applications. If you install this cumulative update, you will not need to install the KB2936068 update offered through MS14-018. There may also be some who overlook the update for Internet Explorer 10. For this version of the browser, the update is non-security. The issues addressed by this bulletin do not impact Internet Explorer 10, but the update does include non-security related changes. For more information about the non-security-related fixes that are included in this update, see Microsoft Knowledge Base Article 2936068.
This security update resolves one publicly disclosed vulnerability and two privately reported vulnerabilities in Microsoft Word. The most severe of these vulnerabilities could allow remote code execution if a specially crafted file is opened in an affected version of Microsoft Office software. This security update also addresses the vulnerability first described in Microsoft Security Advisory 2953095. If you have installed the Fix it provided through this advisory, you should remove it once you apply the update to ensure RTF files open correctly.
Finally, we are revising Security Advisory 2755801 with the latest update for Adobe Flash Player in Internet Explorer. The update addresses the vulnerabilities described in Adobe Security bulletin APSB14-09 For more information about this update, including download links, see Microsoft Knowledge Base Article 2942844.
Watch the bulletin overview video below for a brief summary of today's releases.
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by CVE, visit the Microsoft Bulletin Summary Web page.
William Peteroy and I will host the monthly bulletin webcast, scheduled for Wednesday, April 9, 2014, at 11 a.m. PDT. I invite you to register here, and tune in to learn more about this month’s security bulletins and advisories.
For all the latest information, you can also follow us at @MSFTSecResponse.
Please join me in wishing Windows XP and Office 2003 a fond farewell as they head towards the sunset of their lives. I look forward to hearing your questions about this month’s release in our webcast tomorrow.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
There are times when we get too close to a topic. We familiarize ourselves with every aspect and nuance, but fail to recognize not everyone else has done the same. Whether you consider this myopia, navel-gazing, or human nature, the effect is the same. I recognized this during the recent webcast when someone asked the question – “What’s the difference between a security advisory and a security bulletin?” The answer was simple to me, as I’ve been doing this for years, but the question was valid and it reminded me that not every person on the planet knows all of the ins and outs of Update Tuesday.
Given this month’s release, the question is timely, as we have 11 bulletins and 3 new advisories releasing today. As we look through today’s release, I thought it would be helpful to step back and take a closer look at some of the terminology we use frequently. Let’s begin by taking a look at the bulletins for December.
You may notice the graphic is significantly different from past months. In the new format, where you see circles throughout the deck, that’s the deployment priority. The numbers in squares represent the exploit index and the words in color indicate bulletin severity.
As we review our top bulletin deployment priorities for this month, let’s pause to review the official definition of a security bulletin.
Any other information that IT staff needs to address the issue
But that doesn’t really explain why a security bulletin is released. Simply put, when there is a significant security-related update for something we ship, it goes in a security bulletin. If an issue in software can be corrected by applying new software, it becomes a security bulletin. Update for the Windows kernel? Security bulletin. Cumulative update for Internet Explorer? Security bulletin. Code problem with .NET Framework? Security bulletin. I think you see where I’m going with this.
This month, we have 11 security bulletins, 5 Critical and 6 Important in severity, addressing 24 unique CVEs in Microsoft Windows, Internet Explorer, Office and Exchange. For those who need to prioritize deployment planning we recommend focusing on MS13-096, MS13-097, and MS13-099.
MS13-096 | Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution This security update resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files. As we highlighted through ANS, this update fully resolves the issue first described in Security Advisory 2896666. For those who installed the Fix it released through the advisory, you do not need to uninstall the Fix it prior to installing the update, but we do recommend disabling the Fix it after installation to ensure TIFF images are displayed correctly.
MS13-097 | Cumulative Update for Internet Explorer This security update resolves seven privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user.
MS13-099 | Vulnerability in Microsoft Scripting Runtime Object Library Could Allow Remote Code Execution This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker convinces a user to visit a specially crafted website or a website that hosts specially crafted content. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user.
In addition to the security bulletins, we are also releasing three security advisories this month and revising one more. So how do security advisories differ from security bulletins? After all, sometimes we see updates included in Security Advisories as well – including advisories this month. What’s the difference?
The easiest way to think of advisories is to consider them as a call to action. With bulletins, updates are usually sent out through Windows or Microsoft Update. If you’ve enabled automatic updating, there’s no action for you – the update will be installed and if needed, your system will reboot. Even if you manually apply all updates, bulletins should require nothing more than installing a package and potentially restarting a service or system. Advisories cover topics that potentially affect your security but cannot be resolved through an update alone. Let’s look at the advisories this month as examples.
In this instance, we’re not correcting faulty code; we’re allowing administrators to enforce a default behavior that’s more secure than the non-default setting.
Security Advisory 2871690 – Update to Revoke Non-compliant UEFI Modules This advisory notifies customers that an update is available for Windows 8 and Windows Server 2012 that revokes the digital signatures for specific Unified Extensible Firmware Interface (UEFI) modules. The affected UEFI modules consist of specific Microsoft-signed modules that are either not in compliance with our certification program or their authors have requested that the packages be revoked. This update applies to nine private, third-party UEFI modules used for test purposes only.
While this may seem like something we can address through a security bulletin, these UEFI modules are not known to be in public distribution. In all likelihood, you are not affected. Your friends aren’t affected. No one you know is affected. Still, we can’t be 100% certain that no one is affected, so we’re releasing this advisory with instructions for checking just in case.
Security Advisory 2915720 – Changes in Windows Authenticode Signature Verification This advisory informs customers of an impending change to how Windows verifies Authenticode-signed binaries. It also recommends that developers who sign binaries with Windows Authenticode ensure that their signatures conform to the change by June 10, 2014. The SRD blog covers additional technical details about the changes.
This is an interesting advisory on an interesting topic. It accompanies a security bulletin, MS13-098, which does address an issue in Windows. In addition to resolving a security issue through new code, the update also introduces new functionality. This advisory details the new functionality and provides guidelines to both administrators and developers. The advisory provide some suggested test scenarios to ensure your enterprise and executables are ready for the change. Again, since this change tightens security rather than addresses an issue, it’s more appropriate that we communicate this to you through an advisory.
Finally, we are also revising Security Advisory 2755801 with the latest update for Adobe Flash Player in Internet Explorer. The update addresses the vulnerabilities described in Adobe Security bulletin APSB13-28. For more information about this update, including download links, see Microsoft Knowledge Base Article 2907997.
If you’ve been intrepid enough to read this far down, watch the bulletin overview video below for a brief summary of today’s releases.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, December 11, 2013, at 11 a.m. PST. I invite you to register here, and tune in to learn more about this month’s security bulletins and advisories.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
I hope this in-depth discussion of bulletins and advisories has been worth your time. If so, let me know what other topics you would like to see covered here. I never grow weary of talking about second Tuesday.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
There are times when we get too close to a topic. We familiarize ourselves with every aspect and nuance, but fail to recognize not everyone else has done the same. Whether you consider this myopia, navel-gazing, or human nature, the effect is the same. I recognized this during the recent webcast when someone asked the question – “What’s the difference between a security advisory and a security bulletin?” The answer was simple to me, as I’ve been doing this for years, but the question was valid and it reminded me that not every person on the planet knows all of the ins and outs of Update Tuesday.
Given this month’s release, the question is timely, as we have 11 bulletins and 3 new advisories releasing today. As we look through today’s release, I thought it would be helpful to step back and take a closer look at some of the terminology we use frequently. Let’s begin by taking a look at the bulletins for December.
You may notice the graphic is significantly different from past months. In the new format, where you see circles throughout the deck, that’s the deployment priority. The numbers in squares represent the exploit index and the words in color indicate bulletin severity.
As we review our top bulletin deployment priorities for this month, let’s pause to review the official definition of a security bulletin.
Any other information that IT staff needs to address the issue
But that doesn’t really explain why a security bulletin is released. Simply put, when there is a significant security-related update for something we ship, it goes in a security bulletin. If an issue in software can be corrected by applying new software, it becomes a security bulletin. Update for the Windows kernel? Security bulletin. Cumulative update for Internet Explorer? Security bulletin. Code problem with .NET Framework? Security bulletin. I think you see where I’m going with this.
This month, we have 11 security bulletins, 5 Critical and 6 Important in severity, addressing 24 unique CVEs in Microsoft Windows, Internet Explorer, Office and Exchange. For those who need to prioritize deployment planning we recommend focusing on MS13-096, MS13-097, and MS13-099.
MS13-096 | Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution This security update resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files. As we highlighted through ANS, this update fully resolves the issue first described in Security Advisory 2896666. For those who installed the Fix it released through the advisory, you do not need to uninstall the Fix it prior to installing the update, but we do recommend disabling the Fix it after installation to ensure TIFF images are displayed correctly.
MS13-097 | Cumulative Update for Internet Explorer This security update resolves seven privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user.
MS13-099 | Vulnerability in Microsoft Scripting Runtime Object Library Could Allow Remote Code Execution This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker convinces a user to visit a specially crafted website or a website that hosts specially crafted content. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user.
In addition to the security bulletins, we are also releasing three security advisories this month and revising one more. So how do security advisories differ from security bulletins? After all, sometimes we see updates included in Security Advisories as well – including advisories this month. What’s the difference?
The easiest way to think of advisories is to consider them as a call to action. With bulletins, updates are usually sent out through Windows or Microsoft Update. If you’ve enabled automatic updating, there’s no action for you – the update will be installed and if needed, your system will reboot. Even if you manually apply all updates, bulletins should require nothing more than installing a package and potentially restarting a service or system. Advisories cover topics that potentially affect your security but cannot be resolved through an update alone. Let’s look at the advisories this month as examples.
In this instance, we’re not correcting faulty code; we’re allowing administrators to enforce a default behavior that’s more secure than the non-default setting.
Security Advisory 2871690 – Update to Revoke Non-compliant UEFI Modules This advisory notifies customers that an update is available for Windows 8 and Windows Server 2012 that revokes the digital signatures for specific Unified Extensible Firmware Interface (UEFI) modules. The affected UEFI modules consist of specific Microsoft-signed modules that are either not in compliance with our certification program or their authors have requested that the packages be revoked. This update applies to nine private, third-party UEFI modules used for test purposes only.
While this may seem like something we can address through a security bulletin, these UEFI modules are not known to be in public distribution. In all likelihood, you are not affected. Your friends aren’t affected. No one you know is affected. Still, we can’t be 100% certain that no one is affected, so we’re releasing this advisory with instructions for checking just in case.
Security Advisory 2915720 – Changes in Windows Authenticode Signature Verification This advisory informs customers of an impending change to how Windows verifies Authenticode-signed binaries. It also recommends that developers who sign binaries with Windows Authenticode ensure that their signatures conform to the change by June 10, 2014. The SRD blog covers additional technical details about the changes.
This is an interesting advisory on an interesting topic. It accompanies a security bulletin, MS13-098, which does address an issue in Windows. In addition to resolving a security issue through new code, the update also introduces new functionality. This advisory details the new functionality and provides guidelines to both administrators and developers. The advisory provide some suggested test scenarios to ensure your enterprise and executables are ready for the change. Again, since this change tightens security rather than addresses an issue, it’s more appropriate that we communicate this to you through an advisory.
Finally, we are also revising Security Advisory 2755801 with the latest update for Adobe Flash Player in Internet Explorer. The update addresses the vulnerabilities described in Adobe Security bulletin APSB13-28. For more information about this update, including download links, see Microsoft Knowledge Base Article 2907997.
If you’ve been intrepid enough to read this far down, watch the bulletin overview video below for a brief summary of today’s releases.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, December 11, 2013, at 11 a.m. PST. I invite you to register here, and tune in to learn more about this month’s security bulletins and advisories.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
I hope this in-depth discussion of bulletins and advisories has been worth your time. If so, let me know what other topics you would like to see covered here. I never grow weary of talking about second Tuesday.
Thanks, Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
If you haven’t had a chance to see the movie Gravity, I highly recommend you take the time to check it out. The plot moves a bit slowly at times, but director Alfonso Cuaron’s work portrayal of zero gravity is worth the ticket price alone. Add in stellar acting and you end up with an epic movie that really makes you miss the shuttle program. Still, the movie has its detractors. Specifically, astrophysicist and geek icon Neil deGrasse Tyson has been critical about the movie’s authenticity. To deGrasse Tyson, a lack of authenticity disrupts the movie-going experience.
Similarly, a lack of authenticity can disrupt your computing experience, which leads me to a couple of interesting items in this month’s release. Two advisories this month deal with authenticity by focusing on certificates and cryptography. The first is Security Advisory 286725, which disables the use of the RC4 stream cipher. As computing power increases, cryptographic attacks that were once only theoretical become practical – this is the case with RC4, which was originally designed in 1987. That’s the same year The Simpsons first appeared as shorts on The Tracy Ullman Show. Computing has changed somewhat in that time.
We’ve already taken this step in Windows 8.1 and Internet Explorer 11, and now we’re providing an update to disable its use in other operating systems as well. Rather than automatically disable the cipher, the update provides a registry key that allows developers to eliminate RC4 as an available cipher in their applications. The SRD blog provides a deep dive into RC4 and the implications of disabling it.
Security Advisory 2880823 also impacts cryptography and authenticity but addresses SHA1. We aren’t going to surprise the world by saying we’re turning off support for SHA1 today, but we are announcing a new policy for Certificate Authorities (CAs) that deprecates the use of the SHA1 algorithm in SSL and code signing certificates in favor of the SHA2 algorithm. After January 2016, only SHA2 certificates can be issued. The good folks over on the PKI blog go into more detail about the change.
We have an update regarding a cryptographic function as well, MS13-095 addresses an issue in Digital Signatures that could cause a web service to stop responding if it receives a specially crafted X.509 certificate. Since these certificates are used to ensure authenticity, having the web service go down during negotiation is suboptimal.
Of course, another way to help ensure authenticity throughout your computing experience is to use EMET. An updated version of the program is available today. Of the many improvements, there is an update to the default settings that includes two new application protection profiles for applications. There’s also an update for the Certificate Trust profile that offers more applications protection. Full details about this release can be found on the SRD blog. It may not patch any holes, but it can make it harder to reach any issue that may exist on a system and, if your family is like mine, it will significantly reduce calls from relatives looking for tech support.
Of course it takes more than just authenticity to make a secure computing experience, which leads us to the other updates for November. Today, we released eight bulletins, three Critical and five Important, addressing 19 unique CVEs in Microsoft Windows, Internet Explorer, and Office. For those who need to prioritize their deployment planning we recommend focusing on MS13-090, MS13-088, and MS13-089.
Our Bulletin Deployment Priority graph provides an overview of this month’s priority releases (click to enlarge).
MS13-090 | Cumulative Security Update of Active X Kill Bits This update addresses a remote code execution issue in an ActiveX control by providing a kill bit for associated ActiveX controls. We are aware of limited attacks that exploit this issue. The code execution occurs at the level of the logged on user, so non-admin users would face less of an impact. The remote code execution vulnerability with higher severity rating be fixed in today’s release and we advise customers to prioritize the deployment of MS13-090 for their monthly release. As usual, customer with Automatic Updates enabled will not need to take any action to receive the update. Additional information about this vulnerability is available on the Security Research & Defense blog.
MS13-088 | Cumulative Update for Internet Explorer This security update resolves ten privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user.
MS13-089 | Vulnerability in Windows Graphics Device Interface Could Allow Remote Code Execution This update addresses one privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views or opens a specially crafted Windows Write file in WordPad. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.
Last but not least, we are also providing an update for users of DirectAccess (DA) through Security Advisory 2862152. This security feature bypass issue would require a man-in-the-middle attacker to be successful, but if someone can snoop on your DA connection, it’s possible they could impersonate a legitimate DA server in order to establish connections with legitimate DA clients. The attacker-controlled system could then intercept the target user’s network traffic and potentially determine the encrypted domain credentials. This update, along with the new configuration guidelines available in KB2862152, helps ensure the authenticity of DA connections.
Watch the bulletin overview video below for a brief summary of today’s releases.
Our risk and impact graph shows an aggregate view of this month’s Security and Exploitability Index (click to enlarge).
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by CVE, visit the Microsoft Bulletin Summary Webpage.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, November 13, 2013, at 11 a.m. PST. I invite you to register here and tune in to learn more about this month’s security bulletins and advisories. We’ll provide authentic answers to your update deployment questions, but no zero gravity effects will be employed.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
I look forward to hearing your questions in the webcast tomorrow.
Thanks,
Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
If you haven’t had a chance to see the movie Gravity, I highly recommend you take the time to check it out. The plot moves a bit slowly at times, but director Alfonso Cuaron’s work portrayal of zero gravity is worth the ticket price alone. Add in stellar acting and you end up with an epic movie that really makes you miss the shuttle program. Still, the movie has its detractors. Specifically, astrophysicist and geek icon Neil deGrasse Tyson has been critical about the movie’s authenticity. To deGrasse Tyson, a lack of authenticity disrupts the movie-going experience.
Similarly, a lack of authenticity can disrupt your computing experience, which leads me to a couple of interesting items in this month’s release. Two advisories this month deal with authenticity by focusing on certificates and cryptography. The first is Security Advisory 286725, which disables the use of the RC4 stream cipher. As computing power increases, cryptographic attacks that were once only theoretical become practical – this is the case with RC4, which was originally designed in 1987. That’s the same year The Simpsons first appeared as shorts on The Tracy Ullman Show. Computing has changed somewhat in that time.
We’ve already taken this step in Windows 8.1 and Internet Explorer 11, and now we’re providing an update to disable its use in other operating systems as well. Rather than automatically disable the cipher, the update provides a registry key that allows developers to eliminate RC4 as an available cipher in their applications. The SRD blog provides a deep dive into RC4 and the implications of disabling it.
Security Advisory 2880823 also impacts cryptography and authenticity but addresses SHA1. We aren’t going to surprise the world by saying we’re turning off support for SHA1 today, but we are announcing a new policy for Certificate Authorities (CAs) that deprecates the use of the SHA1 algorithm in SSL and code signing certificates in favor of the SHA2 algorithm. After January 2016, only SHA2 certificates can be issued. The good folks over on the PKI blog go into more detail about the change.
We have an update regarding a cryptographic function as well, MS13-095 addresses an issue in Digital Signatures that could cause a web service to stop responding if it receives a specially crafted X.509 certificate. Since these certificates are used to ensure authenticity, having the web service go down during negotiation is suboptimal.
Of course, another way to help ensure authenticity throughout your computing experience is to use EMET. An updated version of the program is available today. Of the many improvements, there is an update to the default settings that includes two new application protection profiles for applications. There’s also an update for the Certificate Trust profile that offers more applications protection. Full details about this release can be found on the SRD blog. It may not patch any holes, but it can make it harder to reach any issue that may exist on a system and, if your family is like mine, it will significantly reduce calls from relatives looking for tech support.
Of course it takes more than just authenticity to make a secure computing experience, which leads us to the other updates for November. Today, we released eight bulletins, three Critical and five Important, addressing 19 unique CVEs in Microsoft Windows, Internet Explorer, and Office. For those who need to prioritize their deployment planning we recommend focusing on MS13-090, MS13-088, and MS13-089.
Our Bulletin Deployment Priority graph provides an overview of this month’s priority releases (click to enlarge).
MS13-090 | Cumulative Security Update of Active X Kill Bits This update addresses a remote code execution issue in an ActiveX control by providing a kill bit for associated ActiveX controls. We are aware of limited attacks that exploit this issue. The code execution occurs at the level of the logged on user, so non-admin users would face less of an impact. The remote code execution vulnerability with higher severity rating be fixed in today’s release and we advise customers to prioritize the deployment of MS13-090 for their monthly release. As usual, customer with Automatic Updates enabled will not need to take any action to receive the update. Additional information about this vulnerability is available on the Security Research & Defense blog.
MS13-088 | Cumulative Update for Internet Explorer This security update resolves ten privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user.
MS13-089 | Vulnerability in Windows Graphics Device Interface Could Allow Remote Code Execution This update addresses one privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views or opens a specially crafted Windows Write file in WordPad. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.
Last but not least, we are also providing an update for users of DirectAccess (DA) through Security Advisory 2862152. This security feature bypass issue would require a man-in-the-middle attacker to be successful, but if someone can snoop on your DA connection, it’s possible they could impersonate a legitimate DA server in order to establish connections with legitimate DA clients. The attacker-controlled system could then intercept the target user’s network traffic and potentially determine the encrypted domain credentials. This update, along with the new configuration guidelines available in KB2862152, helps ensure the authenticity of DA connections.
Watch the bulletin overview video below for a brief summary of today’s releases.
Our risk and impact graph shows an aggregate view of this month’s Security and Exploitability Index (click to enlarge).
For more information about this month’s security updates, including the detailed view of the Exploit Index broken down by CVE, visit the Microsoft Bulletin Summary Webpage.
Jonathan Ness and I will host the monthly bulletin webcast, scheduled for Wednesday, November 13, 2013, at 11 a.m. PST. I invite you to register here and tune in to learn more about this month’s security bulletins and advisories. We’ll provide authentic answers to your update deployment questions, but no zero gravity effects will be employed.
For all the latest information, you can also follow the MSRC team on Twitter at @MSFTSecResponse.
I look forward to hearing your questions in the webcast tomorrow.
Thanks,
Dustin Childs Group Manager, Response Communications Microsoft Trustworthy Computing
