Today we released Security Advisory 979682 to address an Elevation of Privilege (EoP) vulnerability in the Windows kernel, affecting all currently supported versions of 32-bit Windows. 64-bit versions of Windows, including Windows Server 2008 R2, are not affected. The advisory provides customers with actionable guidance to help with protections against exploit of this vulnerability.

To exploit this vulnerability, an attacker must already have valid logon credentials and be able to log on to a system locally, meaning they must already have an account on the system. An attacker could then elevate their privileges to the administrative level and run programs of their choice on the system.

To help mitigate exploit of this vulnerability, customers who do not require NT Virtual DOS Mode (NTVDM) or support for 16-bit applications, can disable the NTVDM subsystem. Information on this workaround can be found in the Advisory.

We are not currently aware of any active attacks against this vulnerability and believe risk to customers, at this time, is limited. We continue to recommend customers review the mitigations and workarounds detailed in the Security Advisory.

We are also working with our Microsoft Active Protections Program (MAPP) partners to help provide broader protections for customers.

Our teams are continuing to work on an update and we will take appropriate action to protect customers when the update has met the quality bar for broad distribution. That may include releasing the update out-of-band.

The Security Advisory will be updated with any new developments so if you are not already subscribed to our comprehensive alerts, please do so in order to be alerted by email when new information is added.

We will also keep customers apprised of any additional details and updates through the MSRC Blog.

Thanks,

Jerry Bryant

via http://blogs.technet.com/msrc/archive/2010/01/20/security-advisory-979682-released.aspx

Click here to install Flash 10.0.42.34.

Click here to install AIR 1.5.3.

The expanded security advisory explains that critical vulnerabilities could provoke crashes or remote code execution. Adobe Flash Player 10.0.32.18 and earlier versions and Adobe AIR 1.5.2 and earlier versions on all platforms are vulnerable.

7 new vulnerabilities are described cursorily. A patch to an eighth and older vulnerability is also updated. Adobe issues thanks to 6 different researchers for the help they provided with the vulnerabilities.

The advisory also adds that Flash Player version 10.1, which Adobe expects to release in the first half of 2010, will be the last to support PowerPC-based G3 Macs. They are discontinuing support, including security updates, past that version because they are implementing performance enhancements not supported in those processors.

Description: Sun’s implementation of the Java Runtime Environment (JRE) and Java Web Start contains multiple vulnerabilities. A specially crafted Java application, an audio or image file or an applet could trigger one of these vulnerabilities, with consequences ranging from arbitrary code execution with the privileges of the current user to denials-of-service and security restriction bypass. Note that, depending upon configuration, Java applets embedded in web pages may be opened automatically upon the loading of the page. One of the error is that the update mechanism does not update JRE to the new version when running on non-English Windows versions. There are errors in decoding DER encoded data and the parsing of HTTP headers which might lead to memory exhaustion. There is an authentication bypass vulnerability in JRE while verifying HMAC digests. Multiple buffer overflow and integer overflow vulnerabilities have been reported in JRE while processing specially crafted audio and image files. There is a command execution vulnerability in JRE which could be triggered by a specially crafted web page. There is a flaw in the implementation of security model permissions in the Java Web Start Installer. Some technical details for some of these vulnerabilities are publicly available.

Status: Vendor not confirmed, no updates available. [edit] Updates are available

References:
Zero Day Initiative Advisories
http://www.zerodayinitiative.com/advisories/ZDI-09-076
http://www.zerodayinitiative.com/advisories/ZDI-09-077
 http://www.zerodayinitiative.com/advisories/ZDI-09-078
http://www.zerodayinitiative.com/advisories/ZDI-09-079
http://www.zerodayinitiative.com/advisories/ZDI-09-080
Sun Security Advisories
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270476-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270475-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269870-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1
Product Home Page
http://java.sun.com
SecurityFocus BID
http://www.securityfocus.com/bid/36881

for this DO NOT rely on check for updates in JAVA control panel BUT go to http://java.com/en/download/ie_manual.jsp?locale=en&host=java.com:80

if you have a 64 bit version of windows, you need to install the standard 32 bit version AND the 64 bit version http://java.com/en/download/manual.jsp

Description: Adobe Shockwave Player, with over 450 million users, is a multimedia player that allows Adobe Director applications to be published and viewed by a browser that is installed with a Shockwave plug-in.

 Multiple vulnerabilities have been reported in Adobe Shockwave Player, which be triggered by a specially crafted Shockwave content.  There is a error in the way the invalid index is used.  There are also a couple of issues caused by the inappropriate use of the invalid pointer.  And the last issue is a memory corruption error when processing string lengths.

 In all the cases successful exploitation might allow an attacker to execute arbitrary code in the context of the logged on user.

There is not enough public information about these vulnerabilities.

Status: Vendor confirmed, updates available.

References:

 Adobe Security Bulletin (APSB09-16)  http://www.adobe.com/support/security/bulletins/apsb09-16.html

Wikipedia Article on Adobe Shockwave  http://en.wikipedia.org/wiki/

Adobe_Shockwave Product Home Page  http://www.adobe.com/products/shockwaveplayer/

 SecurityFocus BID http://www.securityfocus.com/bid/36905

Adobe recommends Shockwave Player users install Shockwave Player version 11.5.2.602 available here: http://get.adobe.com/shockwave/
Remember: You need to install shockwave in Every Browser you use separately, if you wish to use it in your browser

Mozilla fixes 16 flaws with Firefox 3.5.4:

http://www.computerworld.com/s/article/9140008/Mozilla_fixes_16_flaws_with_Firefox_3.5.4

 Mozilla today patched 16 vulnerabilities in Firefox, 11 of them critical, as it updated the open-source browser to version 3.5.4. 

 The 11 critical Firefox 3.5 vulnerabilities were located in a variety ofn components, including Web worker calls, the GIF color map parser, the string-to-number converter, a trio of third-party media libraries, and both the JavaScript and browser engines.

The Windows 7 numbers are spectacular for an operating system that
hasn’t yet released for global availability. Even better, about 1/3rd
of Windows 7 Microsoft Security Essentials machines are 64-bit, which is
even more resistant to malware than 32-bit due to PatchGuard.

By looking at detections divided by active Microsoft Security Essentials
machines over the whole population, we see far more detections per XP
machine, with the fewest from Win7. This follows our usual observed
trend of seeing less malware on newer OSes and service packs.

Windows Installer uses the registry to record information about updates installed for each Windows Installer-based product. These registry keys help identify the state of each update: registered, applied, superseded, or obsoleted. Information about installed updates is stored across several registry keys and values. To allow for the product to be in a serviceable state in which it can be repaired, updated, or uninstalled, it is critical for the data in these registry keys to be synchronized. When the data in these registry keys is no longer synchronized, maintenance mode operations cannot be performed on the product .msi file.

The Patch Registration Cleanup Tool helps resolve some issues that are related to invalid or corrupted update registration. This tool lets you bring the product back to a known state so that you can reinstall updates.

http://support.microsoft.com/?kbid=976220

direct download for the Patch Registration Cleanup Tool

Applies to all currently supported windows versions from XP SP2 up to Windows 7 including all versions of Vista ( SP1 and higher) & server 2003 (SP2 ) and server 2008

The update includes 13 bulletins that between them tackle 34 vulnerabilities.

Microsoft said that eight of the bulletins were rated as critical – the most serious sort of vulnerability.

The security patches close loopholes in many different programs including different editions of Windows, Internet Explorer and some elements of Office.

One update, rated as critical, tackles a loophole in Internet Explorer 8 running under Windows 7. The next version of Microsoft’s operating system is due to be released on 22 October.

For home users the best way is to use Microsoft update on your computer.

These updates are vital and need to be installed immediately

********************************************************************
Microsoft Security Bulletin Summary for October 2009
Issued: October 13, 2009
********************************************************************

This bulletin summary lists security bulletins released for
October 2009.

The full version of the Microsoft Security Bulletin Summary for
October 2009 can be found at
http://www.microsoft.com/technet/security/bulletin/ms09-oct.mspx.

With the release of the bulletins for October 2009, this bulletin
summary replaces the bulletin advance notification originally issued
on October 8, 2009. For more information about the bulletin
advance notification service, see
http://www.microsoft.com/technet/security/Bulletin/advance.mspx.

To receive automatic notifications whenever Microsoft Security
Bulletins are issued, subscribe to Microsoft Technical Security
Notifications on
http://www.microsoft.com/technet/security/bulletin/notify.mspx.

Microsoft will host a webcast to address customer questions on
these bulletins on Wednesday, October 14, 2009,
at 11:00 AM Pacific Time (US & Canada). 7pm UK time. Register for the
Security Bulletin Webcast at
http://www.microsoft.com/technet/security/bulletin/summary.mspx.

Microsoft also provides information to help customers prioritize
monthly security updates with any non-security, high-priority
updates that are being released on the same day as the monthly
security updates. Please see the section, Other Information.

Critical Security Bulletins
===========================

Microsoft Security Bulletin MS09-050

– Affected Software:
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-051

– Affected Software:
– Microsoft Windows 2000 Service Pack 4:
DirectShow WMA Voice Codec
Windows Media Audio Voice Decoder
Audio Compression Manager
– Windows XP Service Pack 2 and
Windows XP Service Pack 3:
DirectShow WMA Voice Codec
Windows Media Audio Voice Decoder
Audio Compression Manager
– Windows XP Professional x64 Edition Service Pack 2:
DirectShow WMA Voice Codec
Windows Media Audio Voice Decoder
Windows Media Audio Voice Decoder in
Windows Media Format SDK 9.5 x64 Edition
Windows Media Audio Voice Decoder in
Windows Media Format SDK 11
Audio Compression Manager
– Windows Server 2003 Service Pack 2:
DirectShow WMA Voice Codec
Windows Media Audio Voice Decoder
Audio Compression Manager
– Windows Server 2003 x64 Edition Service Pack 2:
DirectShow WMA Voice Codec
Windows Media Audio Voice Decoder
Windows Media Audio Voice Decoder in
Windows Media Format SDK 9.5 x64 Edition
Audio Compression Manager
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2:
Windows Media Audio Voice Decoder
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2:
Windows Media Audio Voice Decoder
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Windows Media Audio Voice Decoder
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Windows Media Audio Voice Decoder

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-052

– Affected Software:
– Microsoft Windows 2000 Service Pack 4:
Microsoft Windows Media Player 6.4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
Microsoft Windows Media Player 6.4
– Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Media Player 6.4
– Windows Server 2003 Service Pack 2
Microsoft Windows Media Player 6.4
– Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Media Player 6.4

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-054

– Affected Software:
– Internet Explorer 5.01 Service Pack 4 when installed on
Microsoft Windows 2000 Service Pack 4
– Internet Explorer 6 Service Pack 1 when installed on
Microsoft Windows 2000 Service Pack 4
– Internet Explorer 6 for
Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Internet Explorer 6 for
Windows XP Professional x64 Edition Service Pack 2
– Internet Explorer 6 for
Windows Server 2003 Service Pack 2
– Internet Explorer 6 for
Windows Server 2003 x64 Edition Service Pack 2
– Internet Explorer 6 for
Windows Server 2003 with SP2 for Itanium-based Systems
– Internet Explorer 7 for
Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Internet Explorer 7 for
Windows XP Professional x64 Edition Service Pack 2
– Internet Explorer 7 for
Windows Server 2003 Service Pack 2
– Internet Explorer 7 for
Windows Server 2003 x64 Edition Service Pack 2
– Internet Explorer 7 for
Windows Server 2003 with SP2 for Itanium-based Systems
– Internet Explorer 7 in
Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Internet Explorer 7 in
Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Internet Explorer 7 in
Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Internet Explorer 7 in
Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Internet Explorer 7 in
Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2
– Internet Explorer 8 for
Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Internet Explorer 8 for
Windows XP Professional x64 Edition Service Pack 2
– Internet Explorer 8 for
Windows Server 2003 Service Pack 2
– Internet Explorer 8 for
Windows Server 2003 x64 Edition Service Pack 2
– Internet Explorer 8 in
Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Internet Explorer 8 in
Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Internet Explorer 8 in
Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Internet Explorer 8 in
Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Internet Explorer 8 in
Windows 7 for 32-bit Systems
– Internet Explorer 8 in
Windows 7 for x64-based Systems
– Internet Explorer 8 in
Windows Server 2008 R2 for x64-based Systems
(Windows Server 2008 R2 Server Core installation not affected)
– Internet Explorer 8 in
Windows Server 2008 R2 for Itanium-based Systems

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-055

– Affected Software:
– Microsoft Windows 2000 Service Pack 4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2
– Windows 7 for 32-bit Systems
– Windows 7 for x64-based Systems
– Windows Server 2008 R2 for x64-based Systems
(Windows Server 2008 R2 Server Core installation not affected)
– Windows Server 2008 R2 for Itanium-based Systems

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-060

– Affected Software:
– Microsoft Outlook 2002 Service Pack 3
– Microsoft Office Outlook 2003 Service Pack 3
– Microsoft Office Outlook 2007 Service Pack 1 and
Microsoft Office Outlook 2002 Service Pack 2
– Visio 2002 Viewer
– Visio 2003 Viewer
– Visio Viewer 2007,
Visio Viewer 2007 Service Pack 1, and
Visio Viewer 2007 Service Pack 2

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-061

– Affected Software:
– Microsoft Windows 2000 Service Pack 4:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
– Media Center Edition 2005 and Tablet PC Edition 2005:
Microsoft .NET Framework 1.0 Service Pack 3
– Windows XP Service Pack 2 and
Windows XP Service Pack 3:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows XP Professional x64 Edition Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2003 Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2003 x64 Edition Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2003 with SP2 for Itanium-based Systems:
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Vista:
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Vista Service Pack 1:
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Vista Service Pack 2:
Microsoft .NET Framework 2.0 Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Vista x64 Edition:
Microsoft .NET Framework 2.0
Microsoft .NET Framework 2.0 Service Pack 1 and
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Vista x64 Edition Service Pack 1:
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Vista Service x64 Edition Service Pack 2:
Microsoft .NET Framework 2.0 Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Server 2008 for 32-bit Systems
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 2.0 Service Pack 2
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Server 2008 for x64-based Systems
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation not affected):
Microsoft .NET Framework 2.0 Service Pack 2
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2:
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Server 2008 for Itanium-based Systems:
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2 and
Microsoft .NET Framework 3.5 Service Pack 1
– Windows Server 2008 for Itanium-based Systems Service Pack 2:
Microsoft .NET Framework 2.0 Service Pack 2
– Windows 7 for 32-bit Systems:
Microsoft .NET Framework 1.1 Service Pack 1
– Windows 7 for x64-based Systems:
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Server 2008 R2 for x64-based Systems
(Windows Server 2008 R2 Server Core installation not affected):
Microsoft .NET Framework 1.1 Service Pack 1
– Windows Server 2008 R2 for Itanium-based Systems:
Microsoft .NET Framework 1.1 Service Pack 1
– Microsoft Silverlight 2 when installed on Mac
– Microsoft Silverlight 2 when installed on all releases of
Microsoft Windows clients
– Microsoft Silverlight 2 when installed on all releases of
Microsoft Windows servers
(Windows Server 2008 Server Core installation and
Windows Server 2008 R2 Server Core installation not affected)
– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-062

– Affected Software:
– Microsoft Windows 2000 Service Pack 4:
Microsoft Internet Explorer 6 Service Pack 1
Microsoft .NET Framework 1.1 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 2.0 Service Pack 2
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista and
Windows Vista Service Pack 1
– Windows Vista x64 Edition and
Windows Vista x64 Edition Service Pack 1
– Windows Server 2008 for 32-bit Systems
(Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for x64-based Systems
(Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for Itanium-based Systems
– Microsoft Office XP Service Pack 3
– Microsoft Office 2003 Service Pack 3
– 2007 Microsoft Office System Service Pack 1 and
2007 Microsoft Office System Service Pack 2
– Microsoft Office Visio 2002 Service Pack 2
– Microsoft Office Project 2002 Service Pack 1
– Microsoft Office Word Viewer,
Microsoft Word Viewer 2003,
Microsoft Word Viewer 2003 Service Pack 3,
Microsoft Office Excel Viewer 2003, and
Microsoft Office Excel Viewer 2003 Service Pack 3
– Microsoft Office Excel Viewer,
PowerPoint Viewer 2007, and
PowerPoint Viewer 2007 Service Pack 1
– PowerPoint Viewer 2007 Service Pack 2
– Microsoft Office Compatibility Pack
for Word, Excel, and PowerPoint 2007 File Formats
Service Pack 1
– Microsoft Office Compatibility Pack
for Word, Excel, and PowerPoint 2007 File Formats
Service Pack 2
– Microsoft Expression Web and
Microsoft Expression Web 2
– Microsoft Office Groove 2007 and
Microsoft Office Groove 2007 Service Pack 1
– Microsoft Works 8.5
– SQL Server 2000 Reporting Services Service Pack 2
– SQL Server 2005 Service Pack 2
– SQL Server 2005 x64 Edition Service Pack 2
– SQL Server 2005 for Itanium-based Systems Service Pack 2
– SQL Server 2005 Service Pack 3
– SQL Server 2005 x64 Edition Service Pack 3
– SQL Server 2005 for Itanium-based Systems Service Pack 3
– Microsoft Visual Studio .NET 2003 Service Pack 1
– Microsoft Visual Studio 2005 Service Pack 1
– Microsoft Visual Studio 2008
– Microsoft Visual Studio 2008 Service Pack 1
– Microsoft Visual FoxPro 8.0 Service Pack 1
when installed on Microsoft Windows 2000 Service Pack 4
– Microsoft Visual FoxPro 9.0 Service Pack 2
when installed on Microsoft Windows 2000 Service Pack 4
– Microsoft Report Viewer 2005 Service Pack 1
Redistributable Package
– Microsoft Report Viewer 2008
Redistributable Package
– Microsoft Report Viewer 2008
Redistributable Package
Service Pack 1
– Microsoft Platform SDK Redistributable: GDI+
– Microsoft Forefront Client Security 1.0
when installed on Microsoft Windows 2000 Service Pack 4

– Impact: Remote Code Execution
– Version Number: 1.0

Important Security Bulletins
============================

Microsoft Security Bulletin MS09-053

– Affected Software:
– Microsoft Windows 2000 Service Pack 4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-056

– Affected Software:
– Microsoft Windows 2000 Service Pack 4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2
– Windows 7 for 32-bit Systems
– Windows 7 for x64-based Systems
– Windows Server 2008 R2 for x64-based Systems
(Windows Server 2008 R2 Server Core installation affected)
– Windows Server 2008 R2 for Itanium-based Systems

– Impact: Spoofing
– Version Number: 1.0

Microsoft Security Bulletin MS09-057

– Affected Software:
– Microsoft Windows 2000 Service Pack 4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems

– Impact: Remote Code Execution
– Version Number: 1.0

Microsoft Security Bulletin MS09-058

– Affected Software:
– Microsoft Windows 2000 Service Pack 4
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2

– Impact: Elevation of Privilege
– Version Number: 1.0

Microsoft Security Bulletin MS09-059

– Affected Software:
– Windows XP Service Pack 2 and
Windows XP Service Pack 3
– Windows XP Professional x64 Edition Service Pack 2
– Windows Server 2003 Service Pack 2
– Windows Server 2003 x64 Edition Service Pack 2
– Windows Server 2003 with SP2 for Itanium-based Systems
– Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
– Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2
– Windows 7 for 32-bit Systems
– Windows 7 for x64-based Systems
– Windows Server 2008 R2 for x64-based Systems
(Windows Server 2008 R2 Server Core installation affected)
– Windows Server 2008 R2 for Itanium-based Systems

– Impact: Denial of Service
– Version Number: 1.0

Other Information
=================

Microsoft Windows Malicious Software Removal Tool:
==================================================
Microsoft will release an updated version of the Microsoft Windows
Malicious Software Removal Tool on Windows Update, Microsoft Update,
Windows Server Update Services, and the Download Center.

Non-Security, High-Priority Updates on MU, WU, and WSUS:
========================================================
For information about non-security releases on Windows Update and Microsoft
update, please see:
* http://support.microsoft.com/kb/894199: Microsoft Knowledge Base
Article 894199, Description of Software Update Services and
Windows Server Update Services changes in content.
Includes all Windows content.
* http://technet.microsoft.com/en-us/wsus/bb456965.aspx: Updates
from Past Months for Windows Server Update Services. Displays all
new, revised, and rereleased updates for Microsoft products other
than Microsoft Windows.

Adobe indicates thatit has received reports of active exploitation of this vulnerability.

Release of an update for this vulnerability is scheduled for Tuesday,October 13.

US-CERT encourages users and administrators to take the followingactions to help mitigate the risks:

 Review Adobe Security Bulletin APSB09-15.

Disable JavaScript in Adobe Reader and Acrobat.

Acrobat JavaScript can be disabled in the General preferences dialog Edit, Preferences, JavaScript, and un-check “Enable Acrobat JavaScript”.

http//www.adobe.com/support/security/bulletins/apsb09-15.html

——————————————

I am not sure whether chosing the same day as Microsoft Patch Tuesday is a good idea or not or will it confuse people more with updates from different sourcces all coming on the same day

Advance Notification for the October 2009 Security Bulletin Release

For October we are releasing 13 bulletins (eight critical and five important), addressing 34 vulnerabilities, affecting Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools, and SQL Server. Most of these updates require a restart so please factor that into your deployment planning.

Among the updates this month, we are closing out two current security advisories:

· Vulnerabilities in SMB Could Allow Remote Code Execution (975497)

· Vulnerabilities in the FTP Service in Internet Information Services (975191)

Usually we do not go into this level of detail in the advance notification but we felt that it is important guidance so customers can plan accordingly and deploy these updates as soon as possible.

The target to release the October security updates is next Tuesday Oct. 13 at 10:00 a.m. PDT (UTC -8). Check back here at that time for a more detailed overview of the updates (including an overview video), our risk and impact summary and our deployment prioritization guide. More information about the upcoming security updates can be found >here in the ANS.

After you have had a chance to read through the bulletins, please join us for a live webcast on Wednesday Oct. 14 at 11:00 a.m. PDT (UTC -7) and get answers to any questions you might have. To register, just follow this link.

Thanks!

Jerry Bryant

*This posting is provided “AS IS” with no warranties, and confers no rights*

via The Microsoft Security Response Center (MSRC) : October 2009 Bulletin Release Advance Notification.