More on Patch Tuesday, July 2009
Posted by: Ed Tittel
Microsoft Patch Tuesday, Microsoft security updates, MS09-029, MS09-028, MS09-032, MS09-022, MS09-031, MS09-030
OK, so today is Wednesday, so that means Patch Tuesday has now come and gone, and the finalized version of the Security Bulletin Summary for July 2009 is now available. In addition to six updates, there’s also an updated version of the Windows Malicious Software Removal tool included amidst this month’s offerings. The following table provides some details on the security-related patches and updates, with links to their underlying individual security bulletins.
| Bulletin ID | Rating | Target | Remarks |
|---|---|---|---|
| MS09-023 | Critical | Microsoft Windows | 2 privately reported remote code execution items in the Windows Embedded OpenType (EOT) Font Engine |
| MS09-028 | Critical | Microsoft Windows | 2 vulnerabilities (1 public, 2 private) in Microsoft DirectShow; opening a specially formatted QuickTime media file can lead to remote execution |
| MS09-032 | Critical | Microsoft Windows | Resolves privately reported vulnerability already being exploited in the MS Video ActiveX control; could lead to remote execution upon viewing a specially crafted Web page in IE with a malicious ActiveX control |
| MS09-033 | Important | Virtual PC Virtual Server | Privately reported vulnerability allows arbitrary code to be executed, or complete control taken for an affected guest OS |
| MS09-031 | Important | ISA Server 2006 | Privately reported vulnerability could allow elevation of privilege upon successful impersonation of administrative account on ISA server configured for Radius One time Password (OTP) authentication and authentication delegation with Kerberos Constrained Delegation |
| MS09-030 | Important | Microsoft Office Publisher | Privately reported vulnerability could allow remote code execution if a user opens a specially crafted Publisher file; could lead to complete control over affected system. |
The critical Windows related items will probably need to be addressed as soon as possible; the other important items may or may not apply to all enterprise situations, but will surely apply to some. For those outfits, the possibility of remote code execution or outright system takeover suggests that they, too, should be addressed quickly.
FWIW, I was able to download and install all these patches on several Vista systems late last night/early this morning without any difficulties. Alas, the same is not true for an optional update to one of my systems Realtek 8111B PCIe GBE Ethernet controller: after three attempts to install same, I’m still scratching my head and wondering why it won’t work. And wouldn’t you know it: the Realtek Web site doesn’t have an update newer than May 2009, while this one is dated for earlier in July. Sigh.
0 Comments
RSS Feed
Email a friend
