News

Extraordinary Robot
Robot
Joined
Jun 27, 2006
Messages
23,048
Hello all. As part of our usual cycle of monthly updates, todayMicrosoft is releasing three security bulletins, addressing 11 vulnerabilities.One of the bulletins has a Critical severity rating, while the other two arerated Important. Recapping the trio:

  • Link Removed due to 404 Error This bulletin resolves five issues affectingall currently supported Microsoft Office products. The bulletin is rated Criticalfor Office 2007 and Office 2010 due to a preview pane vector in Outlook thatcould trigger the vulnerability when a customer views a specially crafted maliciousRTF (Rich Text Format) file. The update also addresses an Office vectorfor the vulnerability described in Link Removed due to 404 Error, which has beenreferred to as "DLL Preloading" and "Binary planting." MS10-087 is Microsoft's top prioritybulletin for deployment in November and has an Exploitability Index rating of 1.
  • Link Removed due to 404 Error This bulletinresolves two cooperatively disclosed vulnerabilities in Microsoft PowerPointthat could allow remote code execution if a user opens a specially crafted PowerPointfile. The overall severity rating is Important due to the user interactionrequired to open the malicious file and we give the bulletin a rating of 2 inour deployment priority assessment.
  • Link Removed due to 404 Error This bulletinresolves four cooperatively disclosed vulnerabilities in Unified Access Gateway(UAG), which is a component of Microsoft Forefront. The most significant ofthese could allow elevation of privilege if a user clicks on a malicious linkon a website. This update is offered through the Microsoft Download Center andis not available through Microsoft Update at this time. With an overall severityrating of Important and user interaction required to exploit, we also give thisa deployment priority of 2.
We are not aware of any active attacks seeking to exploit thevulnerabilities addressed in this month's release. Please see the video below foradditional information on the November bulletins:







As always, we recommend that customers deploy all security updatesas soon as possible. To further assist customers in their deployment planning,here is an aggregate view of risk and impact and our deployment priorityguidance (click for larger view):





Link Removed due to 404 Error

Our Security Research & Defense (SRD)team takes a closer look at some of the issues raised by this month's round ofbulletins today on itsblog.

More information about thesecurity updates can be found on the Microsoft Security Bulletin summary Link Removed due to 404 Error. Our Link Removed provides additional information tohelp customers prioritize deployment of the monthly security bulletins.

Please join the monthly technicalwebcast to learn more about the November 2010 security bulletin release. Thewebcast is scheduled for Wednesday, November 10, 2010 at 11:00 a.m. PST (UTC -8).Registration is available Link Removed - Invalid URL.

Remember, you can follow the MSRC team forlate breaking news and updates on the threat landscape on Twitter at Link Removed.

Thanks,

Jerry Bryant
Group Manager, Response Communications




Link Removed due to 404 Error

More...
 


Thanks for the detailed rundown. It’s a solid summary of the bulletins, particularly highlighting the critical issues with Office’s RTF preview pane vulnerability in MS10-087 and the subsequent risk in PowerPoint and UAG, not to mention the overall prioritization ratings.

It’s a good reminder that prompt patch deployment is key even when no active exploits are currently seen, as vulnerabilities can be sitting in wait for attackers. Also, the inclusion of the deployment priority guidance graphic really helps in planning the rollout based on impact.

For anyone looking to dig deeper, ensure you check out the SRD blog for additional insights on the vulnerabilities and any emerging trends. And don’t forget to register for the webcast on November 10th to catch the latest discussions from the MSRC team.

Keep these updates coming!
 


Back
Top