Microsoft Monthly Updates

Microsoft released this months security bulletins:

Please check your Windows Update:

3 Critical Bulletins
MS05-050 - Vulnerability in DirectShow Could Allow Remote Code Execution (904706)
MS05-051 - Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution
MS05-052 - Cumulative Security Update for Internet Explorer (896688)

4 Important Bulletins:
MS05-046 - Vulnerability in the Client Services for Netware Could Allow Remote Code Execution (899589)
MS05-047 - Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749)
MS05-048 - Vulnerability in the Microsoft Collaboration Objects Could Allow Remote Code Execution (907245)
MS05-049 - Vulnerabilities in Windows Shell Could Allow Remote Code Execution (900725)

2 Moderate Bulletins:
MS05-044 - Vulnerability in the Windows FTP Client Could Allow File Transfer Location and Tampering (905495)
MS05-045 - Vulnerability in Network Connection Manager Could Allow Denial of Service (905414)

Microsoft released this month's Security Bulletin:

1 Critical Update

MS05-053 - Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424)

Affected Software: Windows 2000 Advanced Server, Windows 2000 Datacenter Server, Windows 2000 Professional, Windows 2000 Server, Windows XP Home Edition, Windows XP Professional, Windows Server 2003 for Small Business Server, Windows Server 2003, Datacenter Edition, Windows Server 2003, Enterprise Edition, Windows Server 2003, Standard Edition, Windows Server 2003, Web Edition

Non-Affected Software: Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

As scheduled, Microsoft released its December security bulletins affecting Windows and Internet Explorer:

Critical Bulletins
MS05-054: Cumulative Security Update for Internet Explorer (905915)
Note: Note that MS05-054 addresses the vulnerability discussed in the following advisory:
http://www.microsoft.com/technet/sec...ry/911302.mspx
Install the above update as soon as possible

Important Bulletins
MS05-055: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (908523)

Other non security patches
Update for Windows XP (KB910437)
Update for Windows Server 2003 (KB910437)
Update for Windows XP (KB908521)
Update for Windows Server 2003 (KB908521)
Update for Windows Server 2003 (KB896427)
Update for Windows XP (KB835409)


View the Bulletin Summary in Microsoft website

http://www.microsoft.com/technet/sec.../ms05-Dec.mspx

As always, download the updates only from the vendors website - visit Windows Update and Office Update or Microsoft Update websites or by using Windows' Automatic Updates functionality.

Microsoft Security Bulletin Summary for February, 2006

Microsoft released this month's security bulletins affecting Windows and Microsoft Office. Also affecting Windows Media Player and Internet Explorer (components in Windows):

Bulletins:

2 Critical Bulletins

* MS06-004 - Cumulative Security Update for Internet Explorer (910620)
* MS06-005 - Vulnerability in Windows Media Player Could Allow Remote Code Execution (911565)

5 Important Bulletins

* MS06-006 - Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution (911564)
* MS06-007 - Vulnerability in TCP/IP Could Allow Denial of Service (913446)
* MS06-008 - Vulnerability in Web Client Service Could Allow Remote Code Execution (911927)
* MS06-009 - Vulnerability in the Korean Input Method Editor Could Allow Elevation of Privilege (901190)
* MS06-010 - Vulnerability in PowerPoint 2000 Could Allow Information Disclosure (889167)


Summary:
View the Bulletin Summary in Microsoft website.
http://www.microsoft.com/technet/sec.../ms06-feb.mspx

Reminder:
As always, download the updates only from the vendors website - visit Windows Update and Office Update or Microsoft Update websites. You may also get the updates thru Automatic Updates functionality in Windows system.

Receiving a Failed! error when trying to download/install the following update from Microsoft Update:

Security Update for Windows XP (KB913446)

Failing with error code 0x80242006, that seems to be a common failure for a lot of people, myself included.

D/load the update from here:

http://www.microsoft.com/technet/sec.../MS06-007.mspx

Under "Affected Software", choose the download for the appropriate operating system. Once d/loaded, install the update.

This appears to be a wide spread issue and undoubtedly Microsoft will address it via Windows Update but the above manual install works fine.

Microsoft Security Bulletin Summary for March, 2006

http://www.microsoft.com/technet/sec.../ms06-Mar.mspx

Microsoft Security Bulletin Summary for April, 2006

http://www.microsoft.com/technet/sec.../ms06-Apr.mspx

Today Microsoft released the following Security Bulletin(s):

8 Critical Bulletins:
MS06-021 - Cumulative Security Update for Internet Explorer (916281) It is recommended that you install this update at the same time with MS06-023 as this update could expose this vulnerability or cause application compatibility issues.
MS06-022 - Vulnerability in ART Image Rendering Could Allow Remote Code Execution (918439)
MS06-023 - Vulnerability in Microsoft JScript Could Allow Remote Code Execution (917344)
MS06-024 - Vulnerability in Windows Media Player Could Allow Remote Code Execution (917734)
MS06-025 - Vulnerability in Routing and Remote Access Could Allow Remote Code Execution (911280)
MS06-026 - Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (918547)
MS06-027 - Vulnerability in Microsoft Word Could Allow Remote Code Execution (917336)
MS06-028 - Vulnerability in Microsoft PowerPoint Could Allow Remote Code Execution (916768)
3 Important Bulletins:
MS06-029 - Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)
MS06-030 - Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389)
MS06-032 - Vulnerability in TCP/IP Could Allow Remote Code Execution (917953)
1 Moderate Bulletin:
MS06-031 - Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736)

Read the Bulletin Summary

http://www.microsoft.com/technet/sec.../ms06-jun.mspx

Microsoft has released today the following security bulletins:

5 Critical
Microsoft Security Bulletin MS06-035
Vulnerability in Server Service Could Allow Remote Code Execution (917159)
This update resolves two vulnerabilities in the Server service, the most serious of which could allow remote code execution.
Microsoft Security Bulletin MS06-036
Vulnerability in DHCP Client Service Could Allow Remote Code Execution (914388)
This update resolves a vulnerability in the DHCP Client service that could allow remote code execution.
Microsoft Security Bulletin MS06-037
Vulnerability in Microsoft Excel Could Allow Remote Code Execution (917285)
This update resolves several vulnerabilities in Excel, the most serious of which could allow remote code execution.
Microsoft Security Bulletin MS06-038
Vulnerability in Microsoft Office Could Allow Remote Code Execution (915384)
This update resolves two vulnerabilities in Office, the most serious of which could allow remote code execution.
Microsoft Security Bulletin MS06-039
Vulnerability in Microsoft Office Could Allow Remote Code Execution (915384)
This update resolves two vulnerabilities in Office, the most serious of which could allow remote code execution.
2 Important
Microsoft Security Bulletin MS06-033
Vulnerability in ASP.NET Could Allow Information Disclosure (917283)
This vulnerability could allow an attacker to bypass ASP.Net security and gain unauthorized access to objects in the Application folder explicitly by name. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce useful information that could be used to try to further compromise the affected system.
Microsoft Security Bulletin MS06-034
Vulnerability in Microsoft Internet Information Services using Active Server Pages Could Allow Remote Code Execution (917537)
This vulnerability could allow an attacker to take complete control of an affected system. Note that the attacker must have valid logon credentials, but if a server has been purposely configured to allow users, either anonymous or authenticated, to upload web content such as .ASP pages to web sites, the server could be exploited by this vulnerability.
View the summary and all the details here

http://www.microsoft.com/technet/sec.../ms06-jul.mspx

Microsoft has released today the following security bulletins:

MS06-040 - Vulnerability in Server Service Could Allow Remote Code Execution (921883) Addresses a critical security problem
MS06-041 - Vulnerability in DNS Resolution Could Allow Remote Code Execution (920683)
MS06-042 - Cumulative Security Update for Internet Explorer (918899)
MS06-043 - Vulnerability in Microsoft Windows Could Allow Remote Code Execution (920214)
MS06-044 - Vulnerability in Microsoft Management Console Could Allow Remote Code Execution (917008)
MS06-045 - Vulnerability in Windows Explorer Could Allow Remote Code Execution (921398)
MS06-046 - Vulnerability in HTML Help Could Allow Remote Code Execution (922616)
MS06-047 - Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (921645)
MS06-048 - Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (922968)
MS06-049 - Vulnerability in Windows Kernel Could Result in Elevation of Privilege (920958)
MS06-050 - Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670)
MS06-051 - Vulnerability in Windows Kernel Could Result in Remote Code Execution (917422)

View the summary and all the details here

http://www.microsoft.com/technet/sec.../ms06-aug.mspx