It's a big update Tuesday today

There are several updates from Microsoft for Windows, Internet Explorer and .Net. Oracle has updates for both Java versions 6 and 7. Last but not least Adobe has updates for Flash Player. You can find links for all of these on the side or use the update features.

Edit: It appears that if you have Java 6 installed and you use the updater it will update you to version 7. If for some reason you need to stay on version 6 you can find the update at http://www.java.com/en/download/manual_v6.jsp

It's that time again...

This month we have several patches from Microsoft fixing .NET, Windows Firewall and several Office components. These should be updated as soon as possible.

Oracle also just released update 32 for Java 6. This appears to be a bugfix release.

Last but not least, Adobe has released a fix for Flash Player that fixes a critical issue that is currently being used to infect computers. Install this one as soon as you can.

Updates next Tudsday

Microsoft is releasing several security updates this coming Tuesday. It is also the quarterly update period for Adobe, Oracle so expect updates for Adobe Reader/Acrobat, and possibly Oracle's Java as well. Don't forget to check your other software (like QuickTime/iTunes, Safari, Firefox and/or Google Chrome) for updates.

A note for those with Apple computers running OSX: There is a Java update available in the Apple software update tool that addresses an active exploit being used on the Internet it should be installed ASAP.

I also realized that I never published my post last month for updates. It's a bit late now but it included updates for Adobe Flash as well as Apple QuickTime.

For those interested here is the update list for Microsoft products and a pre-release bulletin for Adobe Reader

Patch Tuesday and Java updates

This last Tuesday was Microsoft's monthly scheduled updates. There were several critical updates that involved Internet Explorer and .NET. Oracle also released a critical update for Java 6 (update 31). These are already starting to see people exploiting the older versions so they should be applied as soon as possible.

Java Update

Yesterday Oracle released Java 6 update 29 (skipping update 28). This release fixes several security issues and should be applied as soon as possible. As usual for java you can update from the Java control panel utility, or directly from the site. You can also check which version you have and see if it needs updated.

October Updates and some definitions

Last Tuesday Microsoft released several updates for Windows, .NET and Office. These should be installed using windows update, either from the start menu or by going to https://www.update.microsoft.com/.

Some terms you might see when looking at updates and what they mean:

• Vulnerability - A flaw in the software that allows an attacker to bypass some kind of security.
• Exploit - The method used to take advantage of a vulnerability.
• Zero-Day Exploit - An exploit that is used before the vendor has published a fix for the vulnerability.
• Remote Code Execution - This type of vulnerability means exactly what it seems to. Someone can run software of their choosing on your computer. The severity of this depends on what else is required for the exploit to work.
• Elevation of Privileges - This type of vulnerability allows an attacker to gain extra privileges (usually full system privileges). This requires the ability to run programs on the system already. When combined with a remote code execution attack it will give the attacker full privileges from what could be an otherwise limited exploit.
• Local/Remote Denial of Service - This type of vulnerability includes system crashes, service crashes, hangs, resource exhaustion, etc. This is usually not a high threat (unless you are a service provider or run some critical systems).
• Data Disclosure - This type of vulnerability can be used to read data from a system (most often a file or data left in memory after a program exits) that the attacker normally wouldn't be able to read. This can include sensitive data and files stored on your system.

Update Tuesday

There were a few updates released by Microsoft last Tuesday. None of them were rated as critical but the update for digital certificates is important to run as there are now 200+ fraudulent certificates that were issued by DigiNotar. Adobe also released a quarterly update to Adobe Reader that fixes some critical security flaws as well as also removing the DigiNotar certificates from the internal certificate trust in Adobe Reader.

Also in my last post I seem to have missed an update by Adobe for Flash Player that addresses some critical flaws.