Microsoft Security Response Center Blog

Security Bulletin Webcast Questions & Answers - September 2008

Friday, September 12, 2008

Hi, During this month’s webcast we were able to address 22 questions in the time allotted. The majority of the questions were regarding the GDI+ update (bulletin number MS08-052). We strongly recommend that you review the bulletin in detail for specific information regarding bulletins superseded by MS08-052, and affected products. Additionally, you will want to review the detection and deployment section to further understand how this update impacts your environment.

• Security Update Webcast Q & A

MS08-052: Explaining the Windows Side-By-Side Cache

Tuesday, September 09, 2008

You may have noticed that the MS08-052 bulletin has a workaround that’s a little different than you’re probably used to seeing in our bulletins. That’s because gdiplus.dll, on all OSes after Windows 2000, is stored in something called the Windows Side By Side Cache (WinSxS). The purpose of the WinSxS cache is to keep old versions of assemblies around in case an application requires a specific version, and doesn’t want newer versions.

• Gdiplus
• Workarounds

MS08-055: Microsoft security response process, behind the scenes

Tuesday, September 09, 2008

One of our blogging goals is to give you a peek “behind the scenes” into our security response process. We thought you might be interested in the story behind MS08-055, this month’s OneNote bulletin. In March, a security researcher sent in a report of an information disclosure vulnerability that affected OneNote 2007, a part of Office 2007.

• Protocol handlers
• Rating
• Workarounds

September 2008 Monthly Bulletin Release

Tuesday, September 09, 2008

I’m Simon, Release Manager in the MSRC. The September 2008 release contains 4 new bulletins, all with maximum severities of “Critical”. MS08-052 Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593) MS08-053 Vulnerability in Windows Media Encoder 9 Could Allow Remote Code Execution (954156) MS08-054 Vulnerability in Windows Media Player Could Allow Remote Code Execution (954154)

Ruminations on Microsoft’s IE8 XSS Filter

Thursday, September 04, 2008

Hi, Amit Klein from Trusteer here. Awhile ago, David Ross from Microsoft SWI contacted me and asked me if I would like to review the new Internet Explorer 8 XSS Filter. Does a chicken like to peck? ;-) Of course I volunteered. My review was conducted in a rather interesting manner.

September 2008 Advanced Notification

Thursday, September 04, 2008

Hello, Bill here. I wanted to let you know that we just posted our Advance Notification for next week’s bulletin release which will occur on Tuesday, September 9, 2008 around 10 a.m. Pacific Standard Time. It is important to remember that while the information posted below is intended to help with your planning, because it is preliminary information, it is subject to change.

The Valley Between Black & Blue

Thursday, August 21, 2008

Handle: C-Lizzle IRL: Celene Temkin Rank: BlueHat Project Manager Likes: Culinary warfare, BlueHat hackers and responsible disclosure Dislikes: Acts of hubris, MySpace, orange mocha Frappaccinos! I affectionately call this time between summer conferences, the black and blue phase, where I wear security like a Hypercolor t-shirt, changing colors depending on where we are in our conference shipping and planning cycles.

• Black Hat
• BlueHat Security Briefings
• Community-based Defense
• Security Conference Engagement
• Security Ecosystem

IE 8 XSS Filter Architecture / Implementation

Tuesday, August 19, 2008

Recently we announced the Internet Explorer 8 XSS Filter and talked a bit about its design philosophy. This post will describe the filter’s architecture and implementation in more detail. Design Goals The Internet Explorer 8 XSS Filter is intended to mitigate reflected / “Type-1” XSS vulnerabilities in a way that does not “break the web.

• Internet Explorer (IE)
• XSS
• XSS Filter

Monthly Security Bulletin Webcast Q&A - August, 2008

Friday, August 15, 2008

Register now for the September 2008 Security Bulletin Webcast. Security Bulletin Webcast Q&A Index Hosts: Christopher Budd, Security Response Communications Lead Adrian Stone, Lead Security Program Manager (MSRC) Website: TechNet/security Chat Topic: August 2008 Security Bulletin Date: Wednesday, August 13, 2008 Q: Have you had any reports of exploitation of the recent DNS vulnerability, since Dan Kaminsky released details at Defcon last week?

• Pages
• Security Update Webcast Q & A

Security Bulletin Webcast Questions & Answers - August 2008

Friday, August 15, 2008

Hi, During this month’s webcast we were able to address 15 questions in the time allotted. There were several questions regarding ActiveX for the Cumulative IE Update (MS08-045), the Access Snapshot Viewer (MS08-041), Outlook Express Messenger (MS08-050) and the ActiveX Kill bits Security Advisory. We also fielded several questions around various deployment tools used for updating and we addressed some questions about the IPSec Update (MS08-047).