Join us for our next Webinar on November 20
Auditing Program Execution with the Security Log
It now more important than ever to control and monitor what software is executing on your network. Without a thorough audit trail of program execution you face increased risks from malware, malicious users and admins, software licensing and it becomes very difficult to investigate incidents of malware infestation, intrusions by hackers and user misbehavior.
- How long did the program run?
Reserve your Webinar seat now at:
https://www.gotomeeting.com/register/187683394
Patch Tuesday Observer
First the big one: MS07-061 is the patch for the IE7-on-pre-Vista vulnerability Microsoft announced last week. This hole is public and being exploited right now. If you are running IE7 on XP or Win2k workstations you need to load this one as soon as possible – even skipping testing. It allows someone to run arbitrary code on workstations under the authority of the user that opens the malicious attachment or clicks on the malicious link. Although computers with IE6 are not currently affected that could change so stay tuned.
The other one applies only to DNS servers. This is one of those indirect vulnerabilities where you can only protect other DNS clients – not yourself as a DNS client. What do I mean by that? DNS servers include random transaction numbers in their queries sent to other DNS servers. Windows DNS Server doesn’t make those numbers random enough which makes it practical for a bad guy to spoof the DNS server and reply with an a different address thus misdirecting clients to an imposter server. This could ultimately allow the bad guy to even impersonate an web server secured with an SSL certificate. (The attacker would also have to obtain a certificate from one of the many, many less strict certification authorities that Windows automatically trusts.) Keeping DNS servers secure is surprisingly important for protecting SSL websites like online banking, e-commerce and the like.
2 other things on the patching front. If you have software with MacroVision’s safedisc (mostly used by game software publishers) you should check out the patch at http://www.macrovision.com/promolanding/7352.htm. Finally, if you use WSUS and have had some corruption problems in the last couple days please see http://blogs.technet.com/wsus/archive/2007/11/13/unexpected-ui-errors-in-wsus.aspx.
| KB # | Exploit Type Product | Principle type of systems exposed | Exploit details public? / Being exploited? | Comprehensive, practical workaround available? | MS severity rating | Vulnerable | Notes | Randy’s recommendation | |||
| 2000 | XP | 2003 | Vista/ 2008 | ||||||||
| MS07-061 (KB943460) | Arbitrary code | Workstations & Terminal Servers | Yes/Yes | No | Critical | No | Yes | Yes | NO | Live exploit is with IE7; Restart required | Patch immediately if IE7 is installed. Patch after testing if IE6 is used. |
| MS07-062 (KB941672) | Spoofing Windows | DNS Servers | No/No | No | Important | Yes | No | Yes | No | DNS; | Patch DNS servers after testing |
Here are some coupon codes you can use! They expire in 7 days though, so don't let this opportunity pass you by.
Edition Coupon code Savings
Bronze QRB $10
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk.
No comments:
Post a Comment