Microsoft have released four bulletins for this month's Patch Tuesday. Three are rated as critical/important and one rated as critical/low, depending on your environment.
In addition, there has been one minor item added and updated since the last Patch Tuesday:
http://support.microsoft.com/kb/982300/
The minor update above is not a security patch as such, but fixes a specific issue with Windows 7 and a particular hardware controller, therefore may not be relevant to all users.
The patches in the table below relate to Microsoft Operating Systems and Office software. These patches affect all operating systems for users who are actively using Outlook Express, Windows Mail and/or Windows Live mail. All of the patches either need a system reboot or may need a system reboot. As usual, these patches address fundamental issues relating to vulnerabilities in the operating system or software which could be used by attackers to compromise your systems.
Microsoft Support Lifecycle News: An important consideration, in addition to Vista from previous months, is for Windows 2000 Server and Windows 2000 for workstations.
The original release of Vista (pre-service pack 1&2) is no longer supported by Microsoft and updates will no longer be offered. The same is true for all flavours of Windows Server 2000 and Windows 2000 for workstations. If you are not currently running SP1 or SP2 for Vista then we strongly advise you consider upgrading, with the usual precautions on updating operating systems. This will ensure Vista can receive updates and be supported. If you are running Windows 2000 server/workstation it may be time to do a bundled upgrade of your hardware and software as these operating systems are now obsolete.
There are a number of viruses and malware that could exploit these vulnerabilities making them a real threat if left open by giving attackers the ability to compromise your systems.
Our usual advice is…
- Ensure that the critical patches are deployed to all Windows desktop and server operating systems and Software, where appropriate, immediately.
- Ensure that all Anti-virus and Malware blocking software packages are fully up to date, and properly configured firewalls are in place within your environment.
- Update your Operating systems with the latest round of Critical patches as soon as possible (MS10-042, MS10-043, MS10-044 & MS10-045)
- Contact us if you require any further advice or guidance on 01206 235000
As always, some consideration is needed in order to evaluate any risks depending on whether you have the relevant affected environment. More details on these patches is given in the table below with links to the relevant Microsoft Knowledge base articles.
Table 1: Details of MS Patches released Tuesday 13/07/2010
| MS Link |
ITSL Summary |
Severity |
Affected Software |
Restart after patch |
|
MS10-042
KB2229593
|
This fixes a security hole in the Windows Help and Support Centre found in Windows XP and Server 2003. You should apply this patch as soon as possible. |
Critical for XP / Low for 2003
|
Windows XP & Server 2003 |
May require restart
|
|
MS10-043
KB2032276
|
A security hole in a windows display driver is allowing remote attacks. Even though Windows a built in feature that makes it hard for this attack to happen, you should install this patch as soon as you can. |
Important for 2008R2 / Critical for Windows 7
|
Windows 7 & 2008R2 |
Yes
|
|
MS10-044
KB982335
|
There is a security problem in Microsoft Office Access which can allow remote attacks. This fix resolves the problem. Since you should be protected to a degree by a default security setting in windows, you can wait until your usual patch cycle for this one. |
Important / Critical
|
Office 2007 |
May require restart
|
|
MS10-045
KB978212
|
This patch resolves an issue in Outlook that allows remote attacks with the same access rights as the logged in user if the user opens an infected attachment. Microsoft doesn’t consider this a big risk because of the limited access rights. We think it is much more important due to it being an issue with opening attachments. You should install this patch quickly. |
Important / Critical
|
Office XP, 2003 & 2007 |
May require restart
|
| Rating |
Definition |
| Critical |
A vulnerability whose exploitation could allow the propagation of an Internet worm without user action. |
| Important |
A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources. |
| Moderate |
Exploitability is mitigated to a significant degree by factors such as default configuration, auditing, or difficulty of exploitation. |
| Low |
A vulnerability whose exploitation is extremely difficult, or whose impact is minimal. |