Updates next Tudsday

Microsoft is releasing several security updates this coming Tuesday. It is also the quarterly update period for Adobe, Oracle so expect updates for Adobe Reader/Acrobat, and possibly Oracle's Java as well. Don't forget to check your other software (like QuickTime/iTunes, Safari, Firefox and/or Google Chrome) for updates.

A note for those with Apple computers running OSX: There is a Java update available in the Apple software update tool that addresses an active exploit being used on the Internet it should be installed ASAP.

I also realized that I never published my post last month for updates. It's a bit late now but it included updates for Adobe Flash as well as Apple QuickTime.

For those interested here is the update list for Microsoft products and a pre-release bulletin for Adobe Reader

Patch Tuesday and Java updates

This last Tuesday was Microsoft's monthly scheduled updates. There were several critical updates that involved Internet Explorer and .NET. Oracle also released a critical update for Java 6 (update 31). These are already starting to see people exploiting the older versions so they should be applied as soon as possible.

Java Update

Yesterday Oracle released Java 6 update 29 (skipping update 28). This release fixes several security issues and should be applied as soon as possible. As usual for java you can update from the Java control panel utility, or directly from the site. You can also check which version you have and see if it needs updated.

October Updates and some definitions

Last Tuesday Microsoft released several updates for Windows, .NET and Office. These should be installed using windows update, either from the start menu or by going to https://www.update.microsoft.com/.

Some terms you might see when looking at updates and what they mean:

• Vulnerability - A flaw in the software that allows an attacker to bypass some kind of security.
• Exploit - The method used to take advantage of a vulnerability.
• Zero-Day Exploit - An exploit that is used before the vendor has published a fix for the vulnerability.
• Remote Code Execution - This type of vulnerability means exactly what it seems to. Someone can run software of their choosing on your computer. The severity of this depends on what else is required for the exploit to work.
• Elevation of Privileges - This type of vulnerability allows an attacker to gain extra privileges (usually full system privileges). This requires the ability to run programs on the system already. When combined with a remote code execution attack it will give the attacker full privileges from what could be an otherwise limited exploit.
• Local/Remote Denial of Service - This type of vulnerability includes system crashes, service crashes, hangs, resource exhaustion, etc. This is usually not a high threat (unless you are a service provider or run some critical systems).
• Data Disclosure - This type of vulnerability can be used to read data from a system (most often a file or data left in memory after a program exits) that the attacker normally wouldn't be able to read. This can include sensitive data and files stored on your system.

Update Tuesday

There were a few updates released by Microsoft last Tuesday. None of them were rated as critical but the update for digital certificates is important to run as there are now 200+ fraudulent certificates that were issued by DigiNotar. Adobe also released a quarterly update to Adobe Reader that fixes some critical security flaws as well as also removing the DigiNotar certificates from the internal certificate trust in Adobe Reader.

Also in my last post I seem to have missed an update by Adobe for Flash Player that addresses some critical flaws.

Microsoft Update Tuesday

It's Microsoft Update Tuesday again. This time there are 8 to 14 updates (depending on the versions of software you have installed) fixing 22 security flaws, including some updates for Internet Explorer. Be sure to install these ASAP (use Microsoft Update from your Start Menu or the website link to the right).

More details about the updates can be found here: http://www.microsoft.com/security/pc-security/bulletins/201008.aspx

Microsoft Update Tuesday

Yesterday was update Tuesday for Microsoft. There are 4 updates and one is rated critical. More info about the updates can be found here: http://aka.ms/1107updates

As usual updates can be started from the start menu in Windows or by going to http://update.microsoft.com