BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Microsoft Patch Tuesday Advanced Notification

Posted April 8, 2010    Chris Silva

Microsoft just released their advanced notification for next week’s Patch Tuesday – and it’s a big one. This time around, Microsoft will be releasing a total of 11 patches, fixing a total of 25 vulnerabilities. They have been classified as:
• Critical (5 Patches)
• Important (5 Patches)
• Moderate (1 Patch)
All currently supported operating systems are affected this month, along with Publisher, Visio and Exchange. Even Exchange 2010, which has an RTM build but is not yet readily available, will receive a security patch.

• Microsoft Windows 2000 (8 Patches)
• Windows XP (8 Patches)
• Windows Server 2003 (7 Patches)
• Windows Vista (5 Patches)
• Windows Server 2008 (6 Patches)
• Windows 7 (3 Patches)
• Windows Server 2008 R2 (4 Patches)
• Office XP (2 Patches)
• Office 2003 (2 Patches)
• Office 2007 (2 Patches)
• Exchange Server 2000 (1 Patch)
• Exchange Server 2003 (1 Patch)
• Exchange Server 2007 (1 Patch)
• Exchange Server 2010 (1 Patch)

Two public zero-day vulnerabilities are included in these patches:

Microsoft Security Advisory 981169 (November 2009)
Vulnerability in VBScript Could Allow Remote Code Execution

Microsoft Security Advisory 977544 (March 2010)
Vulnerability in SMB Could Allow Denial of Service

Also on Tuesday, Oracle and Adobe will also be releasing security patches. As Oracle releases security patches quarterly, expect quite a bit from them.

What does this all mean? Well, if you are a security researcher or anyone in IT who is responsible for securing your corporate network, stock up on the Mountain Dew or your caffeinated beverage of choice and plan on a long night on Tuesday. Check back here on Tuesday for some general analysis of the patches once details are made public.

As usual, eEye Digital Security will be holding a vulnerability expert forum (VEF) on Wednesday April 14 at 11AM PDT. The vulnerability expert forum is a live webcast where the eEye research team will discuss these patches and additional security landscape topics. Be sure to sign up in advance.

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,