Java Update

Yesterday Oracle released Java 6 update 29 (skipping update 28). This release fixes several security issues and should be applied as soon as possible. As usual for java you can update from the Java control panel utility, or directly from the site. You can also check which version you have and see if it needs updated.

October Updates and some definitions

Last Tuesday Microsoft released several updates for Windows, .NET and Office. These should be installed using windows update, either from the start menu or by going to https://www.update.microsoft.com/.

Some terms you might see when looking at updates and what they mean:

• Vulnerability - A flaw in the software that allows an attacker to bypass some kind of security.
• Exploit - The method used to take advantage of a vulnerability.
• Zero-Day Exploit - An exploit that is used before the vendor has published a fix for the vulnerability.
• Remote Code Execution - This type of vulnerability means exactly what it seems to. Someone can run software of their choosing on your computer. The severity of this depends on what else is required for the exploit to work.
• Elevation of Privileges - This type of vulnerability allows an attacker to gain extra privileges (usually full system privileges). This requires the ability to run programs on the system already. When combined with a remote code execution attack it will give the attacker full privileges from what could be an otherwise limited exploit.
• Local/Remote Denial of Service - This type of vulnerability includes system crashes, service crashes, hangs, resource exhaustion, etc. This is usually not a high threat (unless you are a service provider or run some critical systems).
• Data Disclosure - This type of vulnerability can be used to read data from a system (most often a file or data left in memory after a program exits) that the attacker normally wouldn't be able to read. This can include sensitive data and files stored on your system.

Update Tuesday

There were a few updates released by Microsoft last Tuesday. None of them were rated as critical but the update for digital certificates is important to run as there are now 200+ fraudulent certificates that were issued by DigiNotar. Adobe also released a quarterly update to Adobe Reader that fixes some critical security flaws as well as also removing the DigiNotar certificates from the internal certificate trust in Adobe Reader.

Also in my last post I seem to have missed an update by Adobe for Flash Player that addresses some critical flaws.

Microsoft Update Tuesday

It's Microsoft Update Tuesday again. This time there are 8 to 14 updates (depending on the versions of software you have installed) fixing 22 security flaws, including some updates for Internet Explorer. Be sure to install these ASAP (use Microsoft Update from your Start Menu or the website link to the right).

More details about the updates can be found here: http://www.microsoft.com/security/pc-security/bulletins/201008.aspx

Microsoft Update Tuesday

Yesterday was update Tuesday for Microsoft. There are 4 updates and one is rated critical. More info about the updates can be found here: http://aka.ms/1107updates

As usual updates can be started from the start menu in Windows or by going to http://update.microsoft.com

More flash updates

A new Adobe Flash Player update came out last Thursday. This update moves Flash Player to version 10.3.181.34. Adobe isn't really clear on what is in this update. They say it fixes Security Bulletin APSB11-18 but that was supposed to be fixed by the last update. It's possible that the last update didn't completely fix the issue so to be safe you should install this ASAP. As usual, you should check that you have the latest version and upgrade if you don't.

Yet Another Adobe Flash Player Update

Another out-of-band (not in the normal release cycle) security update has been released for Adobe's Flash Player. This update moves it to version 10.3.181.26. You should check that you have the latest version and upgrade if you don't.

This one is being exploited to download and install malicious software to peoples computers already so update as soon as you can.