[Out of band]Microsoft Security Bulletin Advance Notification for January 2013

ronjor · Jan 13, 2013

Published: Sunday, January 13, 2013

Version: 2.0

This is an advance notification for one out-of-band security bulletin that Microsoft is intending to release on January 14, 2013. The bulletin addresses a security vulnerability in Internet Explorer.

This bulletin advance notification will be replaced with the January bulletin summary on January 14, 2013. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

Microsoft will host a webcast to address customer questions on the out-of-band security bulletin on January 14, 2013, at 1:00 PM Pacific Time (US & Canada). Register now for the January 14, 1:00 PM Security Bulletin Webcast. After this date, this webcast is available on-demand.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.
Bulletin Information
Click to expand...

http://technet.microsoft.com/en-us/security/bulletin/ms13-jan

ronjor · Jan 13, 2013

Advance Notification for Update to Address Security Advisory 2794220
MSRCTeam
13 Jan 2013 3:00 PM

Today, we are providing Advance Notification to customers that at approximately 10 a.m. PST on Monday, January 14, 2013, we will release an out-of-band security update to fully address the issue described in Security Advisory 2794220. While we have still seen only a limited number of customers affected by the issue, the potential exists that more customers could be affected in the future. The bulletin has a severity rating of Critical, and it addresses CVE-2012-4792. Internet Explorer 9-10 are not affected by this issue and as always, we encourage customers to upgrade to the latest browser version.
Click to expand...

https://blogs.technet.com/b/msrc/ar...ecurity-advisory-2794220.aspx?Redirected=true

siljaline · Jan 13, 2013

Thank you for this.
Sign-up for security notifications to your Inbox: http://technet.microsoft.com/en-us/security/dd252948.aspx

siljaline · Jan 13, 2013

For those that have applied the below Microsoft FixIt detailed:
http://support.microsoft.com/kb/2794220 | It is not necessary to remove the FixIt if you have applied the "workaround patch".

FanJ · Jan 14, 2013

Thanks guys.
Waiting for the fix to come through

siljaline · Jan 14, 2013

You're welcome, the patch MS13-008 is on Windows Update, now.

FanJ said:

Thanks guys.
Waiting for the fix to come through
Click to expand...

Trooper · Jan 14, 2013

siljaline said:

You're welcome, it should be on Windows Update or will be very shortly.
Click to expand...

Thanks for the heads up!

ronjor · Jan 14, 2013

MS13-008 Released for Security Advisory 2794220
MSRCTeam
14 Jan 2013 10:45 AM

Today, we released MS13-008 to address the issue described in Security Advisory 2794220. We’ve seen only a limited number of attacks through an issue in Internet Explorer 6-8, but the potential exists that more customers could be affected. The majority of customers have automatic updates enabled and will not need to take any action because protections will be downloaded and installed automatically. For those manually updating, we strongly encourage you to apply this update as quickly as possible. As always, we recommend upgrading to Internet Explorer 9-10, as they are not impacted by this issue.
Click to expand...

https://blogs.technet.com/b/msrc/ar...ecurity-advisory-2794220.aspx?Redirected=true

siljaline · Jan 14, 2013

You're welcome, Troop

Trooper said:

Thanks for the heads up!
Click to expand...

FanJ · Jan 14, 2013

Thanks again guys.
Got it
KB 2799329
https://technet.microsoft.com/en-us/security/bulletin/ms13-008

Trooper · Jan 14, 2013

ronjor said:

https://blogs.technet.com/b/msrc/ar...ecurity-advisory-2794220.aspx?Redirected=true
Click to expand...

Thanks Ron.

acuariano · Jan 14, 2013

thanks guys

siljaline · Jan 14, 2013

For those that have just patched, it is suggested that the FixIt be removed, this assumes you did apply the FixIt prior to applying https://technet.microsoft.com/en-us/security/bulletin/ms13-008, per:
http://blogs.technet.com/b/msrc/arc...8-released-for-security-advisory-2794220.aspx

However, the Fix it is no longer needed after the security update is installed, so we are recommending that you uninstall it after you have applied the update to your system.
Click to expand...

ronjor · Jan 14, 2013

Microsoft Security Bulletin MS13-008 - Critical
Security Update for Internet Explorer (2799329)

Published: Monday, January 14, 2013

Version: 1.0
General Information
Executive Summary

This security update resolves one publicly disclosed vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows servers. Internet Explorer 9 and Internet Explorer 10 are not affected. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

This security update also addresses the vulnerability first described in Microsoft Security Advisory 2794220.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Known Issues. None
Click to expand...

http://technet.microsoft.com/en-us/security/bulletin/ms13-008

Log in or Sign up

[Out of band]Microsoft Security Bulletin Advance Notification for January 2013

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

siljaline Registered Member

FanJ Updates Team

siljaline Registered Member

Trooper Registered Member

ronjor Global Moderator

siljaline Registered Member

FanJ Updates Team

Trooper Registered Member

acuariano Registered Member

siljaline Registered Member

ronjor Global Moderator

Log in or Sign up

[Out of band]Microsoft Security Bulletin Advance Notification for January 2013

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

siljaline Registered Member

FanJ Updates Team

siljaline Registered Member

Trooper Registered Member

ronjor Global Moderator

siljaline Registered Member

FanJ Updates Team

Trooper Registered Member

acuariano Registered Member

siljaline Registered Member

ronjor Global Moderator

Useful Searches