Microsoft Security Response Center Blog

Monthly Security Bulletin Webcast Q&A - January 2009

Thursday, January 15, 2009

Register now for the January 2009 Security Bulletin Webcast Security Bulletin Webcast Q&A Index Hosts: Christopher Budd, Security Response Communications Lead Adrian Stone, Lead Security Program Manager (MSRC) Website: TechNet/security Chat Topic: January 2009Security Bulletin Date: Wednesday, January 14, 2009 Q: So just to clarify there is no known code in the wild and if there was to be how would it get injected into the environment?

• Pages
• Security Update Webcast Q & A

Security Bulletin Webcast Questions and Answers - January 2009

Thursday, January 15, 2009

Hi, During this month’s webcast we were able to address 21 questions in the time allotted. We addressed several questions regarding MS09-001 and its relationship to previously released SMB bulletins. There were also questions regarding update deployment and attack vectors addressed. The remaining questions primarily concerned the Malicious Software Removal Tool (MSRT) update regarding the W32/Conficker worm.

January 2009 Monthly Bulletin Release

Tuesday, January 13, 2009

Happy New Year to everyone. As Bill noted in his posting on Thursday, we are releasing one new bulletin today, MS09-001. This bulletin is rated as ‘Critical’ for Windows 2000, Windows XP and Windows Server 2003 and is rated as ‘Moderate’ for Windows Vista and Windows Server 2008. My colleague Mark Wodrich has put together a posting over at the Security Vulnerability Research and Defense (SVRD) weblog which explains more about the vulnerability and the Exploitability Index rating.

Learning by our mistakes

Monday, January 12, 2009

Mike Andrews here. With a very broad brush, the vulnerabilities we see can be split into two categories – flaws and bugs. Flaws are inherent problems with the design of a system/application – Dan Kaminskys’ DNS vulnerability would be a good example. Bugs, on the other hand, are issues with the implementation of the software, and the classic example would be a buffer overflow.

• BlueHat Security Briefings
• Malicious Software (Malware)
• Security Research

MS09-001: Prioritizing the deployment of the SMB bulletin

Friday, January 09, 2009

This month we released an update for SMB that addresses three vulnerabilities. This blog post provides additional information that might help prioritize the deployment of this update, and help explain the risk for code execution. In the bulletin you will see that the cumulative severity rating is Critical for Windows 2000, XP and Server 2003 systems, while Vista and Server 2008 have cumulative severity ratings of Moderate.

• Exploitability
• Kernel
• Rating
• SMB

January 2009 Advanced Notification

Thursday, January 08, 2009

Hello, Bill here. I wanted to let you know that we just posted our Advance Notification for next week’s bulletin release which will occur on Tuesday, Jan. 13, 2009 around 10 a.m. Pacific Standard Time. It is important to remember that while the information posted below is intended to help with your planning, because it is preliminary information, it is subject to change.

Monthly Security Bulletin Webcast Q&A - December 2008

Friday, January 02, 2009

Register now for the January 2009 Security Bulletin Webcast Security Bulletin Webcast Q&A Index Hosts: Christopher Budd, Security Response Communications Lead Adrian Stone, Lead Security Program Manager (MSRC) Website: TechNet/security Chat Topic: December 2008 Security Bulletin Date: Wednesday, December 10, 2008 Q: SANS reported a 0 day not patched in MS08-073; can we anticipate another “out of band” patch if and when Microsoft confirms the vulnerability?

• Pages
• Security Update Webcast Q & A

Security Bulletin Webcast Q&A - OOB December 2008

Friday, January 02, 2009

Register now for the January 2009 Security Bulletin Webcast Security Bulletin Webcast Q&A Index Hosts: Christopher Budd, Security Response Communications Lead Mike Reavey, Group Program Manager (MSRC) Website: TechNet/security Chat Topic: Microsoft out-of-band Security Bulletin (MS08-067) TechNet Webcast Date: Wednesday, December 17, 2008 and Thursday, December 18, 2008 Note: The below questions were submitted from webcast attendees and are not necessarily in the order they were addressed during webcast.

• Pages
• Security Update Webcast Q & A

Information on Microsoft Security Advisory 961509

Tuesday, December 30, 2008

Hi everyone. This is Maarten Van Horenbeeck. I just joined the Microsoft Security Response Center a few months ago, and am the program manager working on the issue described in Microsoft Security Advisory (961509), which we just released. Earlier today, two researchers presented at a security conference on a novel way of implementing collision attacks on digital certificates signed using the MD5 algorithm.

Information regarding MD5 collisions problem

Tuesday, December 30, 2008

Today Microsoft released a security advisory (961509) regarding collisions in MD5 hashes on certificates. This specific problem affects the entire industry and is not a Microsoft specific vulnerability. Serious weaknesses in MD5 have been known for many years now; it is because of these weaknesses that MD5 is banned in new code under the Microsoft Security Development Lifecycle (SDL).

• MD5 hash collisions