Microsoft have released four bulletins for this month's Patch Tuesday.
Three of these bulletins are rated as Important. Particular attention should be paid to update MS10-015 (below), which can cause issues after installation making the machine restart repeatedly. It is advisable that you run the following Microsoft 'Fixit' tool (http://go.microsoft.com/?linkid=9714532) to see if your machine is compatible.
The fourth patch (rated as Low priority) relates to your choice in Internet browsers, which is in reference to a legal issue in Europe around people having a choice of what Internet browser they can use. This was released in late February so you may have already seen an Icon called “Browser Choice” on your desktop. If not, it will appear on your next round of updates and will bring up a list of other browsers that you can choose to install.
There is one patch for Windows Vista/Windows 7 users relating to Movie Maker. Anyone using this product should install this patch immediately. If you are not using this product then this security update is going to have a minimal impact on your business.
These patches relate to Microsoft Operating Systems and Office software. The majority of the supported operating systems are affected this month: Windows 2000, Windows XP, Windows 2003, Windows Vista, Windows 7 and Windows 2008. All of the patches either need a system reboot or may need a system reboot. As usual, these patches address fundamental issues relating to vulnerabilities in the operating system or software which could be used by attackers to compromise your systems. There are a number of viruses and malware that could exploit these vulnerabilities making them a real threat if left open by giving attackers the ability to compromise your systems.
Our usual advice is…
- Ensure that the critical patches are deployed to all Windows desktop and server operating systems and Software, where appropriate, immediately.
- Ensure that all Anti-virus and Malware blocking software packages are fully up to date, and properly configured firewalls are in place within your environment.
- Contact us if you require any further advice or guidance on 01206 235000
As always, some consideration is needed in order to evaluate any risks depending on whether you have the relevant affected environment. More details on these patches is given in the table below with links to the relevant Microsoft Knowledge base articles.
Table 1: Details of MS Patches released Tuesday 09/03/2010
| MS Link |
ITSL Summary |
Severity |
Affected Software |
Restart after patch |
|
MS10-016
KB975561
|
This patch fixes a vulnerability that could be used to transfer a virus via a specially crafted movie file. This program is not usually used in a business environment so this is not critical, patch during your next round of updates. |
Important
|
Windows Vista & Windows 7 |
Yes
|
|
MS10-017
KB980150
|
Microsoft Excel has a vulnerability that could allow a remote user to control and run code on your systems. The attacker would need to be authenticated to exploit this vulnerability. Our advice is to patch desktops ASAP. |
Important
|
Office XP SP3, Office 2003 SP3, Office 2007 SP1 & SP2 |
Yes
|
|
MS10-015
KB977165
|
This is a fix to the Windows Kernel that closed an escalation of privileges hole. This update can cause the computer to restart repeatedly; be careful when installing this. See if your machine is compatible with this update first by running the Microsoft FixIt from the following link.
http://support.microsoft.com/kb/980966/ |
Important
|
Windows 2000, Windows 2003, Windows Vista & Windows 7 |
Yes
|
|
KB976002
|
This patch adds the new “browser ballot” to existing installs of Windows for European users affected by the recent legal actions around this issue. For some reason, they released it out of band in late February, and again on March’s Patch Tuesday. |
Low
|
Windows XP (Pro & Home Editions), Windows Vista & Windows 7 |
No
|
| Rating |
Definition |
| Critical |
A vulnerability whose exploitation could allow the propagation of an Internet worm without user action. |
| Important |
A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources. |
| Moderate |
Exploitability is mitigated to a significant degree by factors such as default configuration, auditing, or difficulty of exploitation. |
| Low |
A vulnerability whose exploitation is extremely difficult, or whose impact is minimal. |