Microsoft security bulletin for April 9 2013

Discussion in 'other security issues & news' started by NICK ADSL UK, Apr 9, 2013.

Thread Status:
Not open for further replies.
  1. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    Microsoft security bulletin for April 9 2013
    Note: There may be latency issues due to replication, if the page does not display keep refreshing

    Today Microsoft released the following Security Bulletin(s).

    Note: www.microsoft.com/technet/security and www.microsoft.com/security are authoritative in all matters concerning Microsoft Security Bulletins! ANY e-mail, web board or newsgroup posting (including this one) should be verified by visiting these sites for official information. Microsoft never sends security or other updates as attachments. These updates must be downloaded from the microsoft.com download center or Windows Update. See the individual bulletins for details.

    Because some malicious messages attempt to masquerade as official Microsoft security notices, it is recommended that you physically type the URLs into your web browser and not click on the hyperlinks provided.

    Bulletin Summary:
    http://technet.microsoft.com/en-us/security/bulletin/ms13-apr


    Critical (2)
    Microsoft Security Bulletin MS13-028
    Cumulative Security Update for Internet Explorer (2817183)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-028

    Microsoft Security Bulletin MS13-029
    Vulnerability in Remote Desktop Client Could Allow Remote Code Execution (2828223)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-029


    Important (7)
    Microsoft Security Bulletin MS13-030
    Vulnerability in SharePoint Could Allow Information Disclosure (2827663)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-030

    Microsoft Security Bulletin MS13-031
    Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2813170)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-031

    Microsoft Security Bulletin MS13-032
    Vulnerability in Active Directory Could Lead to Denial of Service (2830914)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-032

    Microsoft Security Bulletin MS13-033
    Vulnerability in Windows Client/Server Run-time Subsystem (CSRSS) Could Allow Elevation of Privilege (2820917)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-033

    Microsoft Security Bulletin MS13-034
    Vulnerability in Microsoft Antimalware Client Could Allow Elevation of Privilege (2823482)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-034

    Microsoft Security Bulletin MS13-035
    Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege (282181:cool:
    http://technet.microsoft.com/en-us/security/bulletin/ms13-035

    Microsoft Security Bulletin MS13-036
    Vulnerabilities in Kernel-Mode Driver Could Allow Elevation Of Privilege (2829996)
    http://technet.microsoft.com/en-us/security/bulletin/ms13-036

    Please note that Microsoft may release bulletins out side of this schedule if we determine the need to do so.

    If you have any questions regarding the patch or its implementation after reading the above listed bulletin you should contact For home users, no-charge support for security updates (only!) is available by calling 800-MICROSOFT (800-642-7676) in the US or 877-568-2495 in Canada.

    As always, download the updates only from the vendors website - visit Windows Update and Office Update or Microsoft Update websites. You may also get the updates thru Automatic Updates functionality in Windows system.

    Security Tool
    Find out if you are missing important Microsoft product updates by using MBSA.
     
  2. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    TechNet Webcast: Information About the April 2013 Security Bulletin Release

    Event ID: 1032538640


    Starts: Wednesday, April 10, 2013 11:00 AM
    Time zone: (GMT-08:00) Pacific Time (US & Canada)
    Duration: 1 hour(s)


    Language(s): English.


    Product(s): computer security and information security.


    Audience(s): IT Decision Maker, IT Implem_IT Generalist and IT Manager.

    Join us for a brief overview of the technical details of this month's Microsoft security bulletins. We intend to address your concerns in this webcast. Therefore, Microsoft security experts devote most of this webcast to answering the questions that you ask.


    Presented by:

    Dustin Childs, Group Manager, Response Communications, Microsoft Corporation

    and

    TBD


    Register now for the April Security Bulletin webcast.
     
  3. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
  4. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    Microsoft Security Bulletin Minor Revisions - Apr 10, 2013
    Summary

    The following bulletins have undergone minor revision increments.
    Please see the bulletin for more details.

    * MS13-029
    * MS13-apr

    Bulletin Information:

    * MS13-029 - Critical
    http://technet.microsoft.com/security/bulletin/ms13-029

    - Reason for Revision: V1.1 (April 10, 2013): Corrected the
    version number for Remote Desktop Connection Client on
    Windows 7 Service Pack 1 and Windows Server 2008 R2 Service
    Pack 1 from 7.0 to 7.1. This is an informational change only.
    There were no changes to security update files.
    - Originally posted: April 9, 2013
    - Updated: April 10, 2013
    - Bulletin Severity Rating: Critical
    - Version: 1.1

    * MS13-apr
    http://technet.microsoft.com/security/bulletin/ms13-apr
    - Reason for Revision: V1.1 (April 10, 2013): For MS13-029,
    corrected the version number for Remote Desktop Connection
    Client on Windows 7 Service Pack 1 and Windows Server 2008
    R2 Service Pack 1 from 7.0 to 7.1. This is an informational
    change only. There were no changes to security update files.
    - Originally posted: April 9, 2013
    - Updated: April 10, 2013
    - Version: 1.1
     
  5. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    Microsoft Security Bulletin Minor Revisions - April 17, 2013
    Summary

    The following bulletins have undergone minor revision increments.
    Please see the bulletins for more details.

    * MS13-036

    Bulletin Information:

    * MS13-036 - Important


    http://technet.microsoft.com/security/bulletin/ms13-036

    - Reason for Revision: V2.1 (April 17, 2013): Added FAQs to
    provide additional guidance for customers who are having
    difficulties restarting their systems after installing security
    update 2823324. See the Update FAQ for details.
    - Originally posted: April 9, 2013
    - Updated: April 17, 2013
    - Bulletin Severity Rating: Important
    - Version: 2.1
    --
     
  6. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    ********************************************************************
    Title: Microsoft Security Bulletin Re-Releases
    Issued: April 23, 2013
    ********************************************************************

    Summary
    =======
    The following bulletins have undergone a major revision increment.
    Please see the appropriate bulletin for more details.

    * MS13-036 - Important
    * MS13-apr


    Bulletin Information:
    =====================

    * MS13-036 - Important

    http://technet.microsoft.com/security/bulletin/MS13-036
    - Reason for Revision: V3.0 (April 23, 2013): Rereleased
    bulletin to replace the 2823324 update with the 2840149 update
    for NTFS.sys when installed on supported editions of Windows
    Vista, Windows Server 2008, Windows 7, and Windows Server
    2008 R2. See the Update FAQ for details.
    - Originally posted: April 9, 2013
    - Updated: April 23, 2013
    - Bulletin Severity Rating: Important
    - Version: 3.0

    * MS13-apr
    http://technet.microsoft.com/security/bulletin/ms13-apr

    - Reason for Revision: V3.0 (April 23, 2013): For MS13-036,
    replaced the 2823324 update with the 2840149 update for NTFS.sys
    when installed on supported editions of Windows Vista, Windows
    Server 2008, Windows 7, and Windows Server 2008 R2. See bulletin
    for details.
    - Originally posted: April 9, 2013
    - Updated: April 23, 2013
    - Version: 3.0
     
  7. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    Microsoft Security Advisory (2847140)

    Vulnerability in Internet Explorer Could Allow Remote Code Execution

    Published: Friday, May 03, 2013

    Version: 1.0


    General Information

    Executive Summary

    Microsoft is investigating public reports of a vulnerability in Internet Explorer 8. Microsoft is aware of attacks that attempt to exploit this vulnerability.

    Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability.

    This is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

    On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

    We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. In addition, we are actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.

    Microsoft continues to encourage customers to follow the guidance in the Microsoft Safety & Security Center of enabling a firewall, applying all software updates, and installing antimalware software.
    https://technet.microsoft.com/en-us/security/advisory/2847140
     
  8. NICK ADSL UK

    NICK ADSL UK Administrator

    Joined:
    May 13, 2003
    Posts:
    9,217
    Location:
    UK
    Microsoft Security Advisory (2847140)

    Vulnerability in Internet Explorer Could Allow Remote Code Execution

    Published: Friday, May 03, 2013 | Updated: Wednesday, May 08, 2013

    Version: 1.1


    General Information

    Executive Summary

    Microsoft is investigating public reports of a vulnerability in Internet Explorer 8. Microsoft is aware of attacks that attempt to exploit this vulnerability. Applying the Microsoft Fix it solution, "CVE-2013-1347 MSHTML Shim Workaround," prevents the exploitation of this issue. See the Suggested Actions section of this advisory for more information.

    The vulnerability does not affect Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10.

    The vulnerability is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

    On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

    We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. In addition, we are actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.

    http://technet.microsoft.com/security/advisory/2847140


    CVE-2013-1347 MSHTML Shim Workaround
    The Fix it solution that is described in this section is not intended to be a replacement for any security update. We recommend that you always install the latest security updates. However, we offer this Fix it solution as a workaround option for some scenarios.

    For more information about this workaround, go to the following Microsoft Security Advisory website:
    Fix it for me
    http://support.microsoft.com/kb/2847140



    The advisory provides more information about the issue, including the following: •The scenarios in which you might apply or disable the workaround
    •How to manually apply the workaround
    To enable or disable this Fix it solution, click the Fix it button or link under the Enable heading or under the Disable heading, click Run in the File Download dialog box, and then follow the steps in the Fix it wizard.
     
Loading...
Thread Status:
Not open for further replies.