Microsoft have released nine security bulletins for this month’s Patch Tuesday.

Five of these are classed as critical and need immediate attention.

These five critical patches relate to Microsoft Operating Systems & Applications – Office 2000, 2003, 2007, XP, Vista, 2008 and will affect almost all desktops and servers in general use in Small and Medium Business environments. The exception is Internet Explorer, which was the focus of the Emergency Patch Release issued last month.

These patches address fundamental issues relating to vulnerabilities in the applications which could be used by attackers to compromise your systems.

There are a number of viruses and malware that could exploit these vulnerabilities making them a real threat if left open by giving attackers the ability to compromise your systems.

Our advice is twofold…

• Ensure that the 5 critical patches are deployed to all Windows desktop and server operating systems immediately
   
• Ensure that all Anti-virus and Malware blocking software packages are fully up to date, and properly configured firewalls are in place within your environment.

Whilst the other bulletins/patches are considered important, some consideration is needed in order to evaluate any risks depending on whether you have the relevant affected environment. More details on these patches is given in the table below.

In summary…

• Update your Desktop and Server computers immediately with the five critical patches (MS09-043, MS09-044, MS09-037, MS09-038 & MS09-039).
   
• Evaluate if you are using the affected software or operating system for the important patches (MS09-036, MS09-040, MS09-041 & MS09-042).
   
• Please also make sure that all additional IT Security solutions (Anti Virus, Anti Malware and Firewall) are in place, are up to date and are appropriate for your environment.

Table 1: Details of MS Patches released Tuesday 11/8/2009

MS Link	ITSL Summary	Severity	Affected Software	Restart after patch
MS09-043	There are vulnerabilities in the Office Web Components which could allow remote code execution attacks. You should install this patch immediately to protect your systems and users.	Critical	Office 2000, Office XP, Office 2003, Office 2007, ISA 2004, ISA 2006, BizTalk 2002, Visual Studio 2003, Small Business Accounting 2006	May Require Restart
MS09-044	If a user is persuaded to connect to a nasty Terminal Server or PC running Remote Desktop, a hacker can perform remote commands attacks against the client machine. You will want to patch this during your next patch cycle if you do not allow Remote Desktop or terminal Services from outside of the firewall, or patch it immediately if you do allow those connections outside your firewall/network.	Critical	2000, XP, Vista, 2003, 2008, Remote Desktop Connection for Mac 2.0	May Require Restart
MS09-039	This patch corrects a problem with the WINS server in Windows 2000 and 2003 that can allow malicious access to perform a remote code execution attack. If you run a WINS server on either of these two platforms, install this patch now.	Critical	MS 2000, 2003	Yes
MS09-038	Hackers with carefully coded AVI files can perform a remote code execution attack against Windows Media Player. If the user who opened the AVI file is a local administrator, the attacker can take over the PC completely. Install this patch as soon as possible.	Critical	2000, XP, Vista, 2003, 2008	Yes
MS09-037	This patch closes the holes that take advantage of ActiveX in many of Windows sub-components like Windows Media Player and Outlook Express. Install this patch as soon as possible.	Critical	2000, XP, Vista, 2003, 2008	Yes
MS09-041	An attacker with a valid account to a PC can send some code to promote their access privileges. Although important, this is a less serious because the hacker needs to have an account on the network before they can run the code and the affected component is not usually accessible externally.	Important	XP, Vista, 2003, 2008	Yes
MS09-040	Microsoft Message Queuing has a flaw which allows the attacker to promote their access privileges. By default Microsoft Message Queuing is turned off. Apply this patch immediately if you have turned it on.	Important	2000, XP, Vista	Yes
MS09-036	There is a hole in the way Internet Information Services version 7 handles web requests. When the hole is exploited, the Web server (not the entire server) can be locked up until the service is restarted. Publically exposed Web servers should get the update during your next patch cycle.	Important	Vista, 2008	Does not Require Restart
MS09-042	The Telnet service in Windows has a problem which allows hackers to obtain user account information; this patch fixes the hole. By default, Telnet is not enabled. Apply this patch if you run Telnet, especially if you allow Telnet access outside of your network/firewall.	Important	2000, XP, Vista, 2003, 2008	Yes

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Rating	Definition
Critical	A vulnerability whose exploitation could allow the propagation of an Internet worm without user action.
Important	A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources.
Moderate	Exploitability is mitigated to a significant degree by factors such as default configuration, auditing, or difficulty of exploitation.
Low	A vulnerability whose exploitation is extremely difficult, or whose impact is minimal.