Hi, this is Simon, Release Manager in the MSRC. I’d like to introduce you to our November security release. Today we are releasing two new bulletins:
· [**MS07-061**](http://www.microsoft.com/technet/security/Bulletin/MS07-061.mspx): This update addresses a vulnerability in Windows URI handling, which could allow remote code execution and has a maximum severity of Critical. **
· [**MS07-062**](http://www.microsoft.com/technet/security/Bulletin/MS07-062.mspx): This update addresses a vulnerability in DNS which could allow spoofing and has a maximum severity of Important
Additionally we are re-releasing one bulletin:
· [**MS07-049**](http://www.microsoft.com/technet/security/Bulletin/MS07-049.mspx): This update addresses a vulnerability in Virtual PC and Virtual Server and could allow elevation of privilege. This is a change to the installer code only, to address some limited installation problems that we have seen. There’s no change to the update binaries, so if you have already successfully installed this update, you do not need to reinstall it. Please refer to the bulletin revision notes for more detail.
As your probably also aware we recently released [Security Advisory 944653](http://www.microsoft.com/technet/security/advisory/944653.mspx) regarding a vulnerability in secdrv.sys, a [SafeDisc](http://www.macrovision.com/products/games/content_rights_management/safedisc.htm) driver, which is made by Macrovision and shipped in certain versions of Microsoft Windows. Macrovision has also released an Advisory and posted a manual patch to update the system driver, secdrv.sys, on Window XP and Windows Server 2003 systems, which is available at <http://www.macrovision.com/promolanding/7352.htm>. It’s important to note that Microsoft Windows Vista is not affected by this vulnerability. As the vulnerable driver is included with Windows XP and Windows Server 2003 we wanted to make sure you knew that we are working with Macrovision to test the Macrovision update for deployment using Microsoft’s security update process. Once the update has gone through the Microsoft security update testing process, completed deployment testing and is ready for release, Microsoft will release it to customers as part of the Microsoft security update process.
You can find more detailed information on the URI issue resolved in MS07-061 (Advisory 943521) in my colleague Jonathan’s blog entry at <http://blogs.technet.com/msrc/archive/2007/10/10/msrc-blog-additional-details-and-background-on-security-advisory-943521.aspx>.
Finally, some WSUS administrators might have encountered a problem with some WSUS Console data corruption if they synched with the Microsoft WSUS servers in the last few days. For further details on this issue, including the resolution if you have hit this problem, please see the WSUS blog at: <http://blogs.technet.com/wsus/archive/2007/11/13/unexpected-ui-errors-in-wsus.aspx>.
As we do each month, we will be hosting our regular webcast tomorrow at 11 a.m. Pacific Time. We’ll review the bulletins and provide you with answers on the air to your questions from our subject matter experts.
You can register for the webcast here:
<http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032344692&EventCategory=4&culture=en-US&CountryCode=US>
\*This posting is provided "AS IS" with no warranties, and confers no rights.\*[](http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032344692&EventCategory=4&culture=en-US&CountryCode=US)