Critical Windows 7 holes fixed in record Patch Tuesday
Microsoft released a record number of 13 bulletins for 34 vulnerabilities on Patch Tuesday--and the first critical update for Windows 7--as well as fixes for zero-day flaws involving Server Message Block (SMB) and Internet Information Services (IIS).
The most severe of the three SMB flaws, which were first reported last month, could allow an attacker to take control of a computer remotely by sending a specially crafted SMB packet to a computer running the Server service. Exploit code for one of the SMB holes has been posted to the Web, Microsoft said.
Windows 7 is affected by two critical patches intended to mend vulnerabilities that could allow remote code execution if a malicious Web page were viewed, one part of a cumulative security update for Internet Explorer and the other in .Net Framework and Silverlight.
The official release date for Windows 7 is October 22, but the new operating system has been available to some large businesses with volume licenses since the summer. The code was finalized in July.
Other critical patches in the security bulletin for October fix a vulnerability in Windows Media Runtime that could be exploited if a user opened a malicious media file or received malicious streaming content from a Web site or application, and if a specially crafted ASF (Advanced Systems Format) file is played using Windows Media Player 6.4.
Among the critical updates: a cumulative security update of ActiveX Kill Bits that is being exploited and that affects ActiveX controls compiled using Active Template Library (ATL); and another patch resolving several vulnerabilities in ATL ActiveX Controls that could allow remote code execution if a user loaded a malicious component or control. ActiveX and ATLs were the subject of an emergency patch Microsoft released in July.
The final critical bulletin fixes a hole in Windows GDI+ (Graphics Device Interface) that could allow an attacker to take control of a computer if the user viewed a malicious image file using affected software or browsed a malicious Web page.
"Microsoft has repeatedly had to fix problems related to the Graphics Device Interface in Windows, and vulnerabilities in the component have been exploited broadly in the past. We can expect that security researchers will be looking to reverse-engineer today's patches, which may very well lead to exploits being created," said Dave Marcus, director of security research and communications at McAfee Labs.
Related "For the Record" podcast, with Symantec's Ben Greenbaum
Listen now:
Download today's podcast
Nine of the vulnerabilities were previously disclosed, which meant that attackers had time to come up with so-called "zero-day" exploits before the patches were available, Marcus noted.
The most alarming vulnerability in the mix is the SMB flaw, which was introduced by the patch for a different vulnerability, according to Josh Phillips, virus researcher at Kaspersky Lab.
Andrew Storms, director of security operations at nCircle, said the bug that is likely to have the biggest impact will be the critical one that affects Windows Media Runtime and involves a speech codec bug that has limited exploits in the wild. "This is a typical file-parsing issue and similar to vulnerabilities that have allowed attackers to create drive-by attacks that infect unsuspecting video viewers," he said.
Meanwhile, the critical SMB vulnerability is relatively difficult to exploit given default firewall conditions, but the IIS bugs are easy to exploit, Storms added.
"The sheer volume of the bulletins and patches is extreme," said Jason Miller, senior data team leader for Shavlik Technologies. "This is really going to affect administrators. It's going to be very challenging because of the time and research that's going to be needed" to patch systems.
Also released were five bulletins rated "important" to fix vulnerabilities in IIS, for which exploit code has been publicly released and for which there have been limited attacks, along with Windows CryptoAPI, Windows Indexing Service, Windows Kernel, and Local Security Authority Subsystem Service.
The update for Windows CryptoAPI relates to flaws in the way domain names are verified on the Internet, which could allow attackers to impersonate a site and steal information from unsuspecting Web surfers. The holes were revealed by researchers Dan Kaminsky and Moxie Marlinspike at Defcon in August.
Affected software includes Windows 7; Windows 2000; Windows XP; Windows Vista; Server 2003 and 2008; Office XP, 2003, and 2007; Microsoft Office System; SQL Server 2000 and 2005; Silverlight; Visual Studio .Net 2003; Visual Studio 2005 and 2008; Visual FoxPro 8.0 and 9.0; Microsoft Report Viewer 2005 and 2008; Forefront Client Security 1.0; and Office software including Visio, Project, Word Viewer, and Works.
The installation also removes the Win/FakeScanti Trojan, which displays fake malware warnings and then asks computer users to pay for fake antivirus software.
(For more information and analysis from Symantec, listen to my colleague Larry Magid's podcast.)
Update: This story was updated at 2:15 p.m. PDT with additional comment and at 11:47 a.m. PDT with more details and reaction from experts.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
It's been available in beta and RC versions for much much longer than that.
Really, Baconstang- I know your purpose was to cause trouble, but could you at least read the article before making comments like this? It really would help your credibility.
And really Dan, I don't cause trouble, MS does a fine job of that. I just try to bring a little humor to the situation, something which you have never shown much of.
Glass houses indeed! The three of you need to go change your nics to Mo, Larry, and Curly.
And comments like this also do nothing for your reputation, that is, unless you are *trying* to build up your rep as a troll. If that is the case, then bravo! You're doing an excellent job!
Vista and Windows 7 are significantly more secure than XP. There is OS-level support for several different techniques for preventing overflow bugs from having any consistent way to execute their own code.
There are a number of valid reasons for not upgrading to Vista, but security is definitely not one of them. If you're really paranoid about security, you may want to hold off on Windows 7 until it's fully vetted and has had a chance to be attacked in the wild sufficiently, but from the early returns, it's likely to be the most secure consumer OS ever released. (Operating systems with low market share may be safer, since they are less likely to be targeted by exploits, but that doesn't make them more secure.)
http://www.engadget.com/2009/10/12/apple-aware-of-snow-leopard-that-bug-kills-data-is-working-on-a/
What does that have to do with Patch tuesday anyway?
Apple acknowledges Snow Leopard data loss issue
http://news.cnet.com/8301-31021_3-10373064-260.html?tag=mncol
There are cases included in the Apple issue where all data is indeed lost and the home folder replaced with an empty one. Apple is still investigating the issue. You can learn more by researching this before commenting if you go to sites such as Apple.com, macrumors.com, and Appleinsider.com. They all have been covering this data loss quite well.
Here is my source http://securitytube.net/Reverse-Engineering-101-video.aspx
He brings it up during the video that his friend at Microsoft Security Response Center (MSRC) told him the figure of $1M per security vulnerability.
He works at TippingPoint and his friend was the Director of Microsoft Research and it was an academic lecture, its not something you make up in that context infront of students you are teaching about reverse engineering.
Will the patches fix that? 'Cause right now I'm not exactly feeling like my Windows Experience is rockin'.
Don't get me wrong I use both OS 's on my MacBook Pro and I think they are just as good as each other. I just hate it when people try to claim that Snow Leopard is a service pack or Windows 7 is a service pack, their not! Both are a great improvement on their predecessors. Besides why love one OS and shun the other, why not have Snow Leopard and Windows 7 and get the best of both worlds?
Don't get me wrong I use both OS 's on my MacBook Pro and I think they are just as good as each other. I just hate it when people try to claim that Snow Leopard is a service pack or Windows 7 is a service pack, their not! Both are a great improvement on their predecessors. Besides why love one OS and shun the other, why not have Snow Leopard and Windows 7 and get the best of both worlds?
Thanks for reminding folks about that one.
Not Microsoft's fault.... DANGERS fault, and it's time to blame the RIGHT part in this.
...Luxury cars aren't priced for EVERYONE...
I would imagine that Microsoft was mainly acquiring a team that had significant expertise in the consumer smartphone market (somewhere that Microsoft hasn't exactly set the world on fire) rather than looking to improve the Danger systems themselves and put a bunch of resources behind a Java-based environment.
Of course, Microsoft is still ultimately responsible for the whole thing -- part of what they acquired was Danger's obligations to their existing customer base, and they had a responsibility to re-engineer the server platform if it needed it -- regardless of whether they viewed the platform as strategic or not.
Of course this means that the products aren't perfect, so they join the ranks of Linux and OS X for requiring updates.
http://news.cnet.com/8301-1009_3-10154662-83.html
The Macintosh and base Linux kernel operating systems have dominated the top spots for vulnerabilities by operating system over the past three years
Yet remain at the bottom for exploits.
__________________________
Only because they are still 'also-ran' operating system that VERY FEW PEOPLE use.
well it isnt Apple.. LOL
http://www.networkworld.com/news/2009/080609-apple-patches-18-mac-vulnerabilities.html
don't choke on all those apple seeds...
http://blogs.eweek.com/applewatch/content/security/what_market_share_will_attract_malware.html
MS has its good points and bad points. Mac has its good points and bad points. Neither companies' operating systems are necessarily better when it comes to everyday tasks. However, when it comes to security, Mac just really does have a major edge--these are the types of updates that I definitely do not miss.
You do not understand the difference between "vulnerabilities" and "exploits". This difference is described here:
http://blogs.eweek.com/applewatch/content/security/what_market_share_will_attract_malware.html
It also cuts through all the hype to clearly outline why Mac OSX is more secure (in spite of so-called vulnerabilities).
OS X is NOT more secure, though it is is safer. If you store gold bars in a facility in the middle of New York City with armed guards, checkpoints, motion sensors, etc., you are adding security, even if there are frequent attempts to take them. If you bury the gold bars in an unlocked box up in orbit, they are much safer, because few can reach them, but they are not more secure.
The important difference is that if you, personally, are a high value target and sophisticated intruders who are not using a mass targeted vector (like a virus) take interest in you, then simply using a more obscure OS will not be any protection from these sophisticated intruders. They may simply sit down and code a custom attack just to break into your system. The better the actual *security* of your system, the better chance your system has of resisting their attack. That is the sense in which current versions of Windows are more secure. The distinction is important.
Of course there are not perfect OSs, and sorry for my ignorance because i haven't used a mac yet, but at least i know that in linux the update system is superior. Most linux OSs have package management, it controls all the software installed in your machine and update it once there's a new version in the repository.
If there's a security bug, or an important needed upgrade for the kernel or any piece of software, the developers will deliver a patch for it, within days or even hours. And it's open source, so if anyone knows how to fix the bug, then that person can contribute to make the OS better, unlike comercial closed source software.
Btw, before you or someone else call me like that, yes, i'm a linux fanboy and an antiwindows troll, but i'm here in this site because i like to know other people's opinions. Sorry for my english.
Dan, cute spin on the truth there. Everyone needs patches because no one is perfect. That said, remind us again what "critical update" means in M$ parlance, please.
remember 2000? love the thing, xp came and it didn't take until sp2 for me to switch over, and u know what? 7 is so much more... time to drop ur blinded love for old tech
end tell
Let's see how many copies of 7 MS will sell in the first month and then compute that many number of sales the number of Macs ever sold...LOL
Am using 7 Ultimate x64, it's got a feature called BitLocker which can encrypt my hard drives and even flash drives. So in case if it does get stolen, it will remain encrypted. What about snow leopard? Got any innovative feature like BitLocker in your endangered os? well Apple said SL would free up disk space and guess what? it does so by deleting users' data. LOL. That's damn funny!
First off, I just had a facepalm moment. Secondly, Filevault, at the consumer level, is equivalent to BitLocker. The only time BitLocker has the potential to be better is if you need, very high security, ie a government environment. So enough with the BS arguments.
I also read something else about Redmond, and I am not sure I can believe it. Quote:
"The technical experts at Microsoft Windows are annoyed about hardware vendor initiatives, providing computer users with an 'INSTANT-ON' mini-operating system, some Linux variant, which allows the user to browse the internet and do other basic functions without having to invoke the computers operating system first.
The Microsoft sources are quoted as saying, that in their opinion their users enjoy a long wait for Window's extended boot times, as it allows them to do other important things first, before using their computer. Activities like adjusting their lip-stick or making a cup of coffee were mentioned.
Frustrated and unable to match Linux's capabilities in this area, Microsoft will instead focus the efforts of their technical experts on creating a new version of 'INSTANT-OFF'. The source declined going into technical details, as a Microsoft patent application is pending, however, we managed to obtain a rough functional description. Apparently an extra button on the computer's keyboard, to be introduced by the OEM vendors, will operate a mechanical pull-out mechanism of the power plug at the back of one's computer. After past great successes with BSODs (blue-screen-of-death) symptoms, Redmond is quoted in saying, that they feel confident, that their great and unique expertise in this area, will allow them to make great strides, to finalize this new technical feature. Microsoft's chairman Steve Ballmer opined that the new mechanism will double up in funtionality as a cup-holder, and he could not wait for the day he will be able to 'squirt out' this new technical feature Microsoft's vast followership ..."
Progress a la MicroSoft! Enjoy!
Arthur :-)
If Apple really was as good as they would have you believe then why dont they release their OS to run on anything like MS does... Apple makes great HW but they would fall apart as a SW company.. which is why they wont.. cant compete outside of the proprietary toasters.
If your house has been broken into and you FEEL secure doesnt mean that the house IS secure.
In E-Security i've heard this put in other terms but the foundation of it remains the same... Just because they havent issued a patch doesnt mean its not a vulnerability.
Doesnt sound bad to me! I'm still waiting for someone to come up with a FLAWLESS, bug & exploit Free OS. Have yet to see one.
So you not getting patches in a few weeks makes you more secure?
With all the attacks that occur over websites (which are OS agnostic) you think Apple not providing you anything in a few weeks is a good thing?!
This is why Apple users are considered bottom feeders on the tech tree.. you guys are blindfolded, handed a walking stick and tied to a blind man.
This is why Apple users are considered bottom feeders on the tech tree.. you guys are blindfolded, handed a walking stick and tied to a blind man.
"
LOL
nice one
What value does your ignorant comments provide us? That's right. Nothing.
- by MPB October 13, 2009 6:06 PM PDT
- Sorry I submitted twice
- Like this Reply to this comment
-
-
- by Dalkorian October 15, 2009 12:23 PM PDT
- Happens to the best of us.
- Like this
-
Showing 1 of 2 pages (146 Comments)