ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

MS Patch Tuesday head-up: 22 vulnerabilities in Windows, Office

By | July 7, 2011, 10:54am PDT

Summary: Microsoft today announced plans to patch 22 serious security vulnerabilities in its Windows operating system and Office productivity suite. As part of the July Patch Tuesday releases, Microsoft will ship four bulletins.  One of the bulletins will carry a “critical” rating because of a high risk of remote code execution attacks. Three of the four bulletins will [...]

Microsoft today announced plans to patch 22 serious security vulnerabilities in its Windows operating system and Office productivity suite.

As part of the July Patch Tuesday releases, Microsoft will ship four bulletins.  One of the bulletins will carry a “critical” rating because of a high risk of remote code execution attacks.

follow Ryan Naraine on twitterThree of the four bulletins will address security holes in Windows, the company’s flagship operating system. Affected Windows versions include Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.

The Microsoft Office update will ship patches for security problems in Microsoft Visio 2003 Service Pack 3.

The bulletins are slated for release on July 12th at 10:00 a.m. PDT.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

84
Comments

Join the conversation!

Just In

re:Apple OS reaches the user percentage of Window
frizzllefry 15th Jul
@avoidz - People like you said the same thing years ago, only the number was different: "When Apple users claim 10 percent of the market you'll all be infected..." then you went on to "When Apple users claim 25% of the market..." and so on. What will the reasoning be when Apple users reach 80% saturation, and your predictions of woe and doom STILL don't pan out? The fact is: OSX with an unobtrusive AV is more secure and stable than ANY MS product will ever be. Get over it.

And you can save your typical "Fan Boi" crap, I've been with MS since the days of MS-DOS 2.1 who migrated to iMacs in the past 18 months. Since then, I have spent less time fussing over security and stability of my OS's and network and more time actually doing what I am in business to do.
0 Votes
+ -
MS Patch Tuesday - July, 2011
Smart_Neuron 7th Jul
Thanks for the heads-up! :0)
@Smart_Neuron ......................Yes.
iOS:2, Windows:22

Guess it'll be 'Roids next week!
@Gr8Music
So where is the Microsoft style security advisory board for iOS for Apple announces vulnerabilitues and tell you when it's going to be patched *BEFORE* being wildly exploited?
@Samic
As much as I like my MS OS, Apple will have some tough going in Sept.----
duplicate.
@Gr8Music "Guess it'll be 'Roids next week!"
......Roids?????----I guess its better than your sister. Then again..............
0 Votes
+ -
No, it is more like
honeymonster 8th Jul
@Gr8Music

Apple OS X:
1555 Vulnerabilities

Microsoft Windows XP Professional:
472 Vulnerabilities

Awww. More than 3x more vulns in OS X.

Compare apples to apples. A desktop OS is much more complex than a gadget OS. You could compare Windows Phone 7 to iOS, though:

Apple iOS 4.x for iPhone 3GS and later:
134 Vulnerabilities

Microsoft Phone 7:
0 Vulnerabilities

Ewww.
0 Votes
+ -
No, it's more like
ScorpioBlue 8th Jul
More unsubstituted FUD from one of the Redmond professional shills that inhabit these boards.
  • Flagged
@ScorpioBlue More unsubstituted FUD from one of the Redmond professional shills that inhabit these boards.

Feel free to provide information to the contrary. I do like to read.
  • Flagged
He's the one throwing out ridiculous figures. Let's see where they come from and what they consist of.
  • Flagged
0 Votes
+ -
Truth hurts
honeymonster 8th Jul
@ScorpioBlue

But there's still no reason for name calling.

My sources are freely available on secunia:

http://secunia.com/advisories/product/96/
http://secunia.com/advisories/product/22/

http://secunia.com/advisories/product/33401/
http://secunia.com/advisories/product/31370/

No need to get all worked up about it.
  • Flagged
@honeymonster

Hmmm... Let's see...

http://secunia.com/advisories/product/96/?task=advisories_2011

5 Secunia Advisories in 2011
Secunia has issued a total of 5 Secunia advisories in 2011 for Apple Macintosh OS X. Currently, 0% (0 out of 5) are marked as unpatched.


Gee, only 5 for the year? And 12 the year before that? Going back to 2003, by using honeymonster's math 139 = 1555. Unless a "vulnerability" doesn't rate a security advisory. In which case, I can conclude (from that) that there's nothing to worry about.

Not to mention what exploits have taken advantage of these 1555 vulnerabilities.

FUD alert #2
  • Flagged
@ScorpioBlue

Ok let's play. Just for 2011 then.

Apple OS X ( http://secunia.com/advisories/product/96/?task=advisories_2011 ):
120 vulnerabilities

Microsoft Windows 7 ( http://secunia.com/advisories/product/27467/?task=advisories_2011 )
58 vulnerabilities

Hint: Advisories are not the same as vulnerabilities. If the vendor discloses a number of vulnerabilities at the same time (e.g. when they are patched) it is one advisory but several vulnerabilities.

What counts are the vulnerabilities, not in how many chunks the vendor chooses to disclose them.

Apple OS X is still the most crappy OS in terms of vulnerabilities and security. Has been like that for years now.
  • Flagged
And yet as of today for 2011, we only have three pieces of socially engineered malware that takes advantage of all these so-called vulnerabilities. You do understand a vulnerability is not an exploit. Right?

Not to mention your link takes you to the advisories page which just I linked to earlier and it's still at 5 advisories (all of which have been patched, btw). Another inflating of the word "vulnerability", no doubt.

Fear, Uncertanity, Doubt. That's the rule these shills live by. Vulnerabilities are potentialities, exploits are known realities. Know the difference.

I'm glad to see you can create numbers out of thin air.

FUD alert #3
  • Flagged
0 Votes
+ -
Sigh
honeymonster Updated - 8th Jul
@ScorpioBlue

Not to mention your link takes you to the advisories page which just I linked to earlier and it's still at 5 advisories (all of which have been patched, btw). Another inflating of the word "vulnerability", no doubt.

Sigh. I tried to explain it to you. Advisories are how Secunia publishes vulnerabilities. To see (and count) the actual vulnerabilities you will have to view each advisory. Do you think you can manage to click on the links?

Inside the advisories you will find the vulnerabilities described. They are also assigned a CVE number (CVE = common vulnerability enumeration).

Example (whopper Apple patch): http://secunia.com/advisories/45054/

Vulnerability is a *very* precise term. It is common across vendors and not impacted by how the vendor chooses to disclose them.

If you want to be taken seriously in this discussion you really should try to understand the topic.

Fear, Uncertanity, Doubt. That's the rule these shills live by.

Still with the name calling?

I'm glad to see you can create numbers out of thin air.
I linked to my sources. I cannot make you actually read them. Live in ignorance (or inside the RDF) if you want it so badly
  • Flagged
@honeymonster

The problem w/ vuln counts - it only is valid if you don't patch. As long as you install the patches your only concern would be this (from your links):

Vulnerability Report: Microsoft Windows 7
...
Unpatched 7% (5 of 72 Secunia advisories)

Most Critical Unpatched
The most severe unpatched Secunia advisory affecting Microsoft Windows 7, with all vendor patches applied, is rated Highly critical
(cool defcon-2 icon)

-----

Vulnerability Report: Apple Macintosh OS X
...
Unpatched 0% (0 of 5 Secunia advisories)

Most Critical Unpatched
There are no unpatched Secunia advisories affecting this product, when all vendor patches are applied..
(no defcon icon!) We are at defcon-5 baby!!


Lol
  • Flagged
0 Votes
+ -
@~dolittle~ good point
ScorpioBlue 8th Jul
That's another way of looking at it.

Frankly, I don't think all these vulnerabilities mean a hill of beans unless there is something out there to exploit it with. Linux is full of vulnerabilities, yet in the 4 years I've been using it, not once have I been infected with anything on it. That's the bottom line. Not the endless possibilities that come up in testing labs and never make it out the door.

See, this is just another attempt by the Redmond crowd to belittle Apple and Linux security by bringing it down to Microsoft's level of constant infections and sloppy code. It's their new sales pitch. 'You aren't any safer with Linux or Apple so you might as well come back to Microsoft.'

Isn't that right, honeymonster? C'mon. Fess-up.
  • Flagged
@~doolittle~

Actually, if you dig a little deeper into the numbers you'll see that there are 0 unpatched from 2011 for Windows 7: http://secunia.com/advisories/graph/?type=sol&period=2011&prod=27467

But there are 11% Unpatched from 2010: http://secunia.com/advisories/graph/?type=sol&period=2010&prod=27467

A look at OS X's numbers. Again, 0% unpatched from 2011: http://secunia.com/advisories/graph/?type=sol&period=2011&prod=96

But 17% unpatched from 2010: http://secunia.com/advisories/graph/?type=sol&period=2010&prod=96

You can see in the Microsoft Report that it lists unpatched advisories at the top as 5 of 72 Unpatched. However for some reason they don't list OS X's as 0 of 154 unpatched. I'm not sure if that was intended to imply that OS X has no advisories unpatched or if it was just left off for some reason.
  • Flagged
@ScorpioBlue

Enough with the insults.

Number of vulnerabilities is a good measure of code quality.

In that respect, Apple is the worst of the bunch. The BSDs rules, Windows is the best of the mainstream OSes and Linux sits somewhere between Windows and Apple.

Number of "unpatched" vulnerabilities can be a measure of how responsive the vendor is to vulnerabilities actually found. However, unlike the total number of vulnerabilities which is a aggregated number, unpatched vulns are a snapshot of a certain point in time.

In case of Apple it is not even reflective of the real state. The big problem with the way Apple assembles OS X (and maybe also iOS) is that they use a lot of 3rd party components, like libxml.

Apple does not control vulnerability disclosure of those 3rd party libraries/components. 3rd parties will usually patch as fast as possible, resulting in a public disclosure of vulnerabilities. From then on, anyone using those components are in the high-risk period until they patch the component within their stack. This happens frequently for Apple. They left a Java vulnerability which allowed total system compromise sit for 8 months *after* Sun had patched it.

The key point here: That vuln was never reported as "unpatched" in the Apple OS. It was first reported (and counted) when Apple actually patched it. So Apple's "unpatched" numbers are quite a bit higher than reported. This is an artifact of how the Apple OS X is assembled - not because of some dubious scheme to hide vulns (although I suspect Apple doesn't mind).

At this very point you will be able to find reported and patched vulnerabilities in componenty such as libxml (I've done that before) and find those vulnerabilities in the OS X stack simply by looking up the version number. And yet they are not reported "unpatched".
  • Flagged
Answer my question, @honeymonster.

And stop being evasive. We all know why you're here and isn't for any concern for Apple or Linux users.
Make sure Ed reads this.
(edited to add this link:) http://www.zdnet.com/tb/1-98809-1924782

Thanks Ryan.
@914four
Whe the hell is going to click on a link?---are you for real???
----Is it for Viagra?
Do you mean I'll be able to get a half day/day back because I won't be fixing these leaks anymore?
YEAHHH!
Maybe Microsoft will become second in the list of time wasters behind the IRS.
@ejmiller@...

Huh?

How are they wasting time by fixing holes in their OS? Or are you saying that an OS should never be patched?
@goff256 Or are you saying that an OS should never be patched?

Of course he is... because there are no patches for OS X, or Linux.... oh wait....
  • Flagged
Of course he is... because there are no patches for OS X, or Linux.... oh wait....

They used to call them "bugs". Now the wintards call them "vulnerabilities". However they are vulnerabilities without exploits. You go figure it out.
  • Flagged
@ScorpioBlue However they are vulnerabilities without exploits. You go figure it out.

Oh that's an easy one, though not one that a certain segment likes to admit... Market Share.

Having said that, it is probably safer to use OS X for the time being... Though not necessarily more "secure".
  • Flagged
Oh that's an easy one, though not one that a certain segment likes to admit... Market Share.

Yeah, but I've always been of the school that believes marketshare is bullsh!t so that doesn't wash. Especially considering half the webservers out there right now are Linux/Unix based.
  • Flagged
@ScorpioBlue Yeah, but I've always been of the school that believes marketshare is bullsh!t so that doesn't wash.

Hence the "certain segment". It's okay, if I were stuck in an RDF, I wouldn't believe it either.

Especially considering half the webservers out there right now are Linux/Unix based.

Odd, I thought it was well more than half. Anyway, it seems to me the script kiddies trying to get your CC Info, would rather have you at your Desktop machine so that you could give it to them when you see a fake anti-virus pop-up. You know, desktops... where Microsoft is still around 90%+/-... Hence the Market Share argument you dismiss.
  • Flagged
Hence the "certain segment". It's okay, if I were stuck in an RDF, I wouldn't believe it either.

Yeah, but I'm not an Apple user so I don't qualify for the RDF. lol...

Anyway, it seems to me the script kiddies trying to get your CC Info, would rather have you at your Desktop machine so that you could give it to them when you see a fake anti-virus pop-up.

Ah, but I believe Linux users are too smart to fall for that kind of nonsense. Otherwise they wouldn't be using Linux in the first place. Who knows. Maybe they got burned one too many times and got a clue.

You know, desktops... where Microsoft is still around 90%... Hence the Market Share argument you dismiss.

Linux was built on security from the ground up. Unlike Windows where security came as an afterthought, band-aided on after the fact. That's what explains the difference. Marketshare is just an excuse by apologists for bad behavior and sloppy code.
  • Flagged
@ScorpioBlue Linux was built on security from the ground up.

Really?

http://secunia.com/advisories/product/2719/


Affected By 270 Secunia advisories
585 Vulnerabilities
Unpatched 6% (17 of 270 Secunia advisories)


You'd think a product "built on security from the ground up" would look a little better than that.
  • Flagged
OSX and Linux still get patched regularly, which was my point.
@goff256 OSX and Linux still get patched regularly, which was my point.

Of course they are, as they should be. My first reply to you was sarcastic.

In the end they are no different from Windows in terms of security... Vulnerabilities exist, they get patched. Unfortunately some people still manage to think they are.
0 Votes
+ -
I knew you were being sarcastic
Michael Alan Goff 8th Jul
It was everyone else who is all srs business.
@Badgered

I guess I'll have to repeat myself again.

Frankly, I don't think all these vulnerabilities mean a hill of beans unless there is something out there to exploit it with. Linux is full of vulnerabilities, yet in the 4 years I've been using it, not once have I been infected with anything on it. That's the bottom line. Not the endless possibilities that come up in the testing labs and never make it out the door.

No anti-virus, no anti-malware programs, whatsoever.

Now you can come up with a million scare tactics on Secunia, but it's not gonna change a thing. Once a month I judiciously patch something on Linux if the distro's forum I'm a part of, recommends it. They call them "bugs" which since they're a part of it's development, I would tend to believe them over anything Secunia puts out.

Maybe you should try it sometime before you believe the FUD created elsewhere. Companies like Secunia have a vested interest in keeping their industry alive and what better way to do it then sound alarmist all the time.
Four Words For You
Shut the **** Up!
@ejmiller@... Try plugging a huge hole,like your mouth. This is a safety issue. Unless your bleeding your neighbors WiFi a mile away it will take 3 minutes .........ever heard of broadband?----KOOK...duh.
Guess the only os left to use is chrome, until hackers trash it too. sheeeshh, cant we just shoot them all.
@vger_z Sorry Chrome has been hacked according to WIRE magazine. Check there web sight for the new Beta version. Just a warning to the wise.
Anyone know if there's been any recent windows updates meant to thwarte pirated windows7 installs? I wouldn't put it out of the realm of possibility that they would simply put some Genuine Advatage Anti-Piracy nuke bomb in one of these urgent critical updates...everyone installs and the pirates can't bootup til 'fixed' again...What's the deal with these scenarios these days anyway?
@GBleezy
Easy:
1) Don't Pirate Window OS.
2) Tell your mom to change your diapers.
3) Pirate everything else under the sun.
@GBleezy

The blocking of pirated copies of WIn7 by ProductID is still being done by Microsoft. Of course, they know full well that piracy acts like viral marketing and helps to increase Windows installed base so they don't tighten the screws too much.
0 Votes
+ -
Drats!
ego.sum.stig@... 7th Jul
Another thing to do on Tuesday. Should I put it before or after my "Conquer the World" item on my "to do."
@ego.sum.stig@... No, first brush your teeth then get a life!
0 Votes
+ -
Why on earth would I want to do that?
ego.sum.stig@... 7th Jul
Brush my teeth and get a life. After all, it's not as though bouncing around testing system updates isn't what happens every month at this time.

I recommend you get your knickers untwisted, and develop a sense of humour or at least get a thicker skin. Oh, but I'd wait on all that until after Tuesday.
  • Flagged
0 Votes
+ -
One does wonder why this was flagged
ego.sum.stig@... 8th Jul
But then again...
0 Votes
+ -
You shouldn't wonder
Michael Alan Goff 8th Jul
Flagging is the easiest way to disagree.

You don't have to have actual points, or any real debate, if you can just get their posts removed.
  • Flagged
Flagging is the easiest way to disagree.

Works both ways, little man.
  • Flagged
0 Votes
+ -
I guess it's a symptom
ego.sum.stig@... 8th Jul
Or perhaps the curse of zdnet usa. Perhaps they are all that's left when one outsources your own mind. Either that or farm animals know more about the technics of IT.
  • Flagged
@avoidz - People like you said the same thing years ago, only the number was different: "When Apple users claim 10 percent of the market you'll all be infected..." then you went on to "When Apple users claim 25% of the market..." and so on. What will the reasoning be when Apple users reach 80% saturation, and your predictions of woe and doom STILL don't pan out? The fact is: OSX with an unobtrusive AV is more secure and stable than ANY MS product will ever be. Get over it.

And you can save your typical "Fan Boi" crap, I've been with MS since the days of MS-DOS 2.1 who migrated to iMacs in the past 18 months. Since then, I have spent less time fussing over security and stability of my OS's and network and more time actually doing what I am in business to do.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix