Seven shiny new patches from Microsoft to kick start the New Year. One is “Critical” and rest are “Important”. MS12-006 has some known issue so be very careful when applying this patch.
2011 was very busy with patches. Let’s hope that 2012 gives us all a trouble free year.
As usual do not forget to check updates from other manufacturers - have a look at their websites and see if any products you may use are in need of an update.
Firefox (Mozilla): www.mozilla.org/security/announce/
Adobe: www.adobe.com/support/security/
Apple: support.apple.com/kb/HT1222
Google: googlechromereleases.blogspot.com/search/label/Stable updates
The patches in the table below relate to Microsoft Operating Systems and Office software. All of the patches either need a system reboot or may need a system reboot.
As usual, these patches address fundamental issues relating to vulnerabilities in the operating system or software which could be used by attackers to compromise your systems.
There are a number of viruses and malware that could exploit these vulnerabilities making them a real threat if left open by giving attackers the ability to compromise your systems.
Our usual advice is…
- Ensure that the critical patches are deployed to all Windows desktop and server operating systems and Software, where appropriate, immediately.
- Ensure that all Anti-virus and Malware blocking software packages are fully up to date, and properly configured firewalls are in place within your environment.
- In addition to any Microsoft updates look at your software portfolio and investigate and consider any updates available from the software developers.
As always, some consideration is needed in order to evaluate any risks depending on whether you have the relevant affected environment. More details on these patches are given in the table with links to the relevant Microsoft Knowledge base articles.
Table 1: Details of MS Patches released Tuesday 10/01/2012
| MS Link |
ITSL Summary |
Severity |
Affected Software |
Restart after patch |
|
MS12-001
KB2644615
|
Software (applications) made with Visual C++ .NET 2003 can be created to get around some security features. Patch this during your next patch cycle.
|
Important |
XP, Vista, W7, 2003, 2008, 2008 R2
|
Restart Required
|
|
MS12-002
KB2603381
|
This flaw could allow a remote attacker to run a file to gain access. Apply during your next patch cycle. |
Important |
XP, 2003 |
May Require a Restart |
|
MS12-003
KB2646524
|
A bug in one of the core operating system files could allow someone to take control of the system. However, they would have to be logged on to the system and it also only affects Chinese, Japanese, or Korean system locale. This can wait until your next round of patching. |
Important |
XP, Vista, 2003, 2008 |
Restart Required |
|
MS12-004
KB2636391
|
A cleverly crafted media file could allow a remote attack. Because of the popularity if the media file we recommend you patch this ASAP. |
Critical |
XP, Vista, W7, 2003, 2008, 2008 R2 |
Restart Required |
|
MS12-005
KB2584146
|
An embedded file in a Microsoft Office document could gain access to the users system. Although Microsoft consider this “Important” we would give it a higher rating as MS Office files are widely used. Patch this ASAP. Once the patch is installed you will now get a warning if the embedded file tries to run without the uses approval. |
Important |
XP, Vista, W7, 2003, 2008, 2008 R2 |
May Require a Restart |
|
MS12-006
KB2643584
|
This update fixes some vulnerability in SSL 3.0 and TLS 1.0 (Web Encryption). Please be aware that there are some known problems with this patch and some website may not work after applying it. Read the knowledge base article for more details: KB2643584. Patch during your next cycle |
Important |
XP, Vista, W7, 2003, 2008, 2008 R2 |
Restart Required |
|
MS12-007
KB2607664
|
Software using the Anti-Cross Site Scripting (AntiXSS) is fixed with this patch. This can wait until your next round of patching. |
Important |
Anti-Cross Site Scripting Library 3.X and 4.0 |
May Require a Restart |