Microsoft Security Bulletin Advance Notification for November 2013

ronjor · Nov 7, 2013

Clarification on Security Advisory 2896666 and the ANS for the November 2013 Security Bulletin Release

by Dustin C. Childs

Today, we’re providing advance notification for the release of eight bulletins, three Critical and five Important, for November 2013. The Critical updates address vulnerabilities in Internet Explorer and Microsoft Windows, and the Important updates address issues in Windows and Office. While this release won’t include an update for the issue first described in Security Advisory 2896666 , we’d like to tell you a bit more about it. We’re working to develop a security update...
Click to expand...

https://blogs.technet.com/b/msrc/ar...ecurity-bulletin-release.aspx?Redirected=true

ronjor · Nov 7, 2013

Microsoft Security Bulletin Advance Notification for November 2013

Published: Thursday, November 07, 2013

Version: 1.0

This is an advance notification of security bulletins that Microsoft is intending to release on November 12, 2013.

This bulletin advance notification will be replaced with the November bulletin summary on November 12, 2013. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

Microsoft will host a webcast to address customer questions on the security bulletins on November 13, 2013, at 11:00 AM Pacific Time (US & Canada). Register now for the November Security Bulletin Webcast.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.
Click to expand...

https://technet.microsoft.com/en-us/security/bulletin/ms13-nov

See Executive Summaries in the bulletin

siljaline · Nov 11, 2013

ActiveX Control issue being addressed in Update Tuesday

Late last Friday, November 8, 2013, a vulnerability, CVE-2013-3918, affecting an Internet Explorer ActiveX Control was publically disclosed. We have confirmed that this vulnerability is an issue already scheduled to be addressed in “Bulletin 3”, which will be released as MS13-090, as listed in the November Advanced Notification Service (ANS). The security update will be distributed to customers tomorrow via Windows Update at approximately 10:00 AM PDT. Customers who have Automatic Updates enabled will not need to take any action to receive the update.
Click to expand...

http://blogs.technet.com/b/msrc/arc...-issue-being-addressed-in-update-tuesday.aspx

siljaline · Nov 11, 2013

Microsoft to patch just-revealed Windows zero-day tomorrow

Monday afternoon, Microsoft confirmed that it will patch the flaw tomorrow as part of its regularly-scheduled monthly security updates. According to Microsoft, the bug is in all supported client editions of Windows, ranging from the 12-year-old Windows XP to the just-released Windows 8.1.
Click to expand...

http://www.computerworld.com/s/arti...patch_just_revealed_Windows_zero_day_tomorrow

ronjor · Nov 12, 2013

Authenticity and the November 2013 Security Updates

Dustin C. Childs

If you haven't had a chance to see the movie Gravity, I highly recommend you take the time to check it out. The plot moves a bit slowly at times, but director Alfonso Cuaron's work portrayal of zero gravity is worth the ticket price alone. Add in stellar acting and you end up with an epic movie that really makes you miss the shuttle program. Still, the movie has its detractors. Specifically, astrophysicist and geek icon Neil deGrasse Tyson has been critical about the movie's authenticity. To deGrasse Tyson, a lack of authenticity disrupts the movie-going experience.

Similarly, a lack of authenticity can disrupt your computing experience, which leads me to a couple of interesting items in this month's release. Two advisories this month deal with authenticity by focusing on certificates and cryptography. The first is Security Advisory 286725, which disables the use of the RC4 stream cipher. As computing power increases, cryptographic attacks that were once only theoretical become practical - this is the case with RC4, which was originally designed in 1987. That's the same year The Simpsons first appeared as shorts on The Tracy Ullman Show. Computing has changed somewhat in that time.
Click to expand...

https://blogs.technet.com/b/msrc/ar...er-2013-security-updates.aspx?Redirected=true

ronjor · Nov 12, 2013

Microsoft Security Bulletin Summary for November 2013

Published: Tuesday, November 12, 2013

Version: 1.0

This bulletin summary lists security bulletins released for November 2013.

With the release of the security bulletins for November 2013, this bulletin summary replaces the bulletin advance notification originally issued November 7, 2013. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.

For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications.

Microsoft is hosting a webcast to address customer questions on these bulletins on November 13, 2013, at 11:00 AM Pacific Time (US & Canada). Register now for the November Security Bulletin Webcast.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.
Bulletin Information
Executive Summaries

The following table summarizes the security bulletins for this month in order of severity.

For details on affected software, see the next section, Affected Software.
Click to expand...

https://technet.microsoft.com/en-us/security/bulletin/ms13-nov

ronjor · Nov 12, 2013

Technical details of the targeted attack using IE vulnerability CVE-2013-3918

swiat

Over the weekend we became aware of an active attack relying on an unknown remote code execution vulnerability of a legacy ActiveX component used by Internet Explorer. We are releasing this blog to confirm one more time that the code execution vulnerability will be fixed in today’s UpdateTuesday release and to clarify some details about the second vulnerability reported.
Click to expand...

http://blogs.technet.com/b/srd/arch...tack-using-cve-2013-3918.aspx?Redirected=true

Log in or Sign up

Microsoft Security Bulletin Advance Notification for November 2013

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

siljaline Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

Microsoft Security Bulletin Advance Notification for November 2013

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

siljaline Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches