MS Security Bulletin Summary - November 2012

FYI…

- http://technet.microsoft.com/en-us/securit…lletin/ms12-nov
November 13, 2012 - "This bulletin summary lists security bulletins released for November 2012…
(Total of -6-)

Microsoft Security Bulletin MS12-071 - Critical
Cumulative Security Update for Internet Explorer (2761451)
- http://technet.microsoft.com/en-us/securit…lletin/ms12-071
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

Microsoft Security Bulletin MS12-072 - Critical
Vulnerabilities in Windows Shell Could Allow Remote Code Execution (2727528)
- https://technet.microsoft.com/en-us/securit…lletin/ms12-072
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS12-074 - Critical
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2745030)
- http://technet.microsoft.com/en-us/securit…lletin/ms12-074
Critical - Remote Code Execution - May require restart - Microsoft Windows, Microsoft .NET Framework

Microsoft Security Bulletin MS12-075 - Critical
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2761226)
- https://technet.microsoft.com/en-us/securit…lletin/ms12-075
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS12-076 - Important
Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2720184)
- http://technet.microsoft.com/en-us/securit…lletin/ms12-076
Important - Remote Code Execution - May require restart - Microsoft Office

Microsoft Security Bulletin MS12-073 - Moderate
Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Information
- https://technet.microsoft.com/en-us/securit…lletin/ms12-073
Moderate - Information Disclosure - May require restart - Microsoft Windows
___

Bulletin Deployment Priority
- https://blogs.technet.com/cfs-filesystemfil…-Deployment.png

Severity and Exploitabilty Index
- https://blogs.technet.com/cfs-filesystemfil…12-Severity.png

- http://blogs.technet.com/b/msrc/archive/20…Redirected=true
13 Nov 2012 - "… six security bulletins… four Critical, one Important, and one Moderate – addressing 19 vulnerabilities in Microsoft Windows Shell, Windows Kernel, Internet Explorer, Internet Information Services (IIS), .NET Framework, and Excel…"
___

- https://secunia.com/advisories/51202/ - MS12-071
- https://secunia.com/advisories/51221/ - MS12-072
- https://secunia.com/advisories/51235/ - MS12-073
- https://secunia.com/advisories/51236/ - MS12-074
- https://secunia.com/advisories/51239/ - MS12-075
- https://secunia.com/advisories/51242/ - MS12-076
___

ISC Analysis
- https://isc.sans.edu/diary.html?storyid=14503
Last Updated: 2012-11-13 18:43:04 UTC
___

MSRT
- http://support.microsoft.com/?kbid=890830
November 13, 2012 - Revision: 116.0
- http://www.microsoft.com/security/pc-secur…e-families.aspx
"… added in this release…
• Folstart
• Phorpiex
• Weelsof …"

- https://blogs.technet.com/b/mmpc/archive/20…Redirected=true
13 Nov 2012 - "… good practice to show hidden files and system files file extensions…"
- https://www.microsoft.com/security/portal/b…/Folstart/3.png
… How to display hidden files and folders, and show file extensions

Download:
- http://www.microsoft.com/download/en/detai…ng=en&id=16
File Name: Windows-KB890830-V4.14.exe - 16.5 MB
- https://www.microsoft.com/download/en/details.aspx?id=9905
x64 version of MSRT:
File Name: Windows-KB890830-x64-V4.14.exe - 17.1 MB

.

FYI… Per comments/info below, you may choose -not- to install this item:

"An IPv6 readiness update is available for Windows 7 and for Windows Server 2008 R2"
- http://support.microsoft.com/kb/2750841
November 13, 2012 - Revision: 1.0
___

From: Susan Bradley
Subject: Do not install KB2750841

http://support.microsoft.com/kb/2750841
Do -not- install that

Threads here:
http://forums.opendns.com/comments.php?DiscussionID=16465
here
http://answers.microsoft.com/en-us/windows…3e-03d8cb305a57
and
https://isc.sans.edu/diary.html?storyid=14503#comment
"After applying the updates, in the Network Notification Area, I get 'Additional log on info may be required'…"

FYI…

MSRT November '12 …
- https://blogs.technet.com/b/mmpc/archive/20…Redirected=true
4 Dec 2012
> https://www.microsoft.com/security/portal/b…lsof/Weels4.png

> https://www.microsoft.com/security/portal/b…lsof/Weels5.png
___

Unexpected reboot: Necurs
- https://blogs.technet.com/b/mmpc/archive/20…Redirected=true
6 Dec 2012 - "Necurs is a prevalent threat in the wild at the moment - variants of Necurs were reported on 83,427 unique machines during the month of November 2012. Necurs is mostly distributed by drive-by download. This means that you might be -silently- infected by Necurs when you visit websites that have been compromised by exploit kits such as Blackhole. So what does Necurs actually do? At a high level, it enables further compromise by providing the functionality to:
- Download additional malware
- Hide its components
- Stop security applications from functioning
In addition Necurs contains backdoor functionality, allowing remote access and control of the infected computer. Necurs also monitors and filters network activity and has been observed to send spam and install rogue security software. Nefariousness aplenty. See our Trojan:Win32/Necurs* family write-up for the full details… we've had reports from a number of users stating that they're having trouble with the Microsoft Security Essentials real time protection option being turned off after their computer has rebooted. We will continue to monitor variants of Necurs in the wild…"
* http://www.microsoft.com/security/portal/T…an:Win32/Necurs
Updated: Dec 05, 2012