3 replies to this topic

[AplusWebMaster]

FYI...

- http://technet.micro...lletin/ms12-dec
December 11, 2012 - "This bulletin summary lists security bulletins released for December 2012...
(Total of 7)

Microsoft Security Bulletin MS12-077 - Critical
Cumulative Security Update for Internet Explorer (2761465)
- http://technet.micro...lletin/ms12-077
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

Microsoft Security Bulletin MS12-078 - Critical
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2783534)
- http://technet.micro...lletin/ms12-078
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS12-079 - Critical
Vulnerability in Microsoft Word Could Allow Remote Code Execution (2780642)
- http://technet.micro...lletin/ms12-079
Critical - Remote Code Execution - May require restart - Microsoft Office

Microsoft Security Bulletin MS12-080 - Critical
Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2784126)
- http://technet.micro...lletin/ms12-080
Critical - Remote Code Execution - May require restart - Microsoft Server Software

Microsoft Security Bulletin MS12-081 - Critical
Vulnerability in Windows File Handling Component Could Allow Remote Code Execution (2758857)
- http://technet.micro...lletin/ms12-081
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS12-082 - Important
Vulnerability in DirectPlay Could Allow Remote Code Execution (2770660)
- http://technet.micro...lletin/ms12-082
Important - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS12-083 - Important
Vulnerability in IP-HTTPS Component Could Allow Security Feature Bypass (2765809)
- http://technet.micro...lletin/ms12-083
Important - Security Feature Bypass - Requires restart - Microsoft Windows
___

- http://blogs.technet...Redirected=true

Bulletin Deployment Priority:
- https://blogs.techne...6355.Slide2.PNG

Severity and Exploitability Index:
- https://blogs.techne...0550.Slide1.PNG

- http://blogs.technet...Redirected=true
___

ISC Analysis
- https://isc.sans.edu...l?storyid=14683
Last Updated: 2012-12-12 01:54:45 UTC
___

- https://secunia.com/advisories/51411/ - MS12-077
- https://secunia.com/advisories/51459/ - MS12-078
- https://secunia.com/advisories/51467/ - MS12-079
- https://secunia.com/advisories/51474/ - MS12-080
- https://secunia.com/advisories/51493/ - MS12-081
- https://secunia.com/advisories/51497/ - MS12-082
- https://secunia.com/advisories/51500/ - MS12-083
___

MSRT
- http://support.micro...om/?kbid=890830
December 11, 2012 - Revision: 117.0
- http://www.microsoft...e-families.aspx
"... added in this release...
• Phdet ..."
- https://blogs.techne...Redirected=true

Download:
- https://www.microsof...i...ng=en&id=16
File Name: Windows-KB890830-V4.15.exe - 16.8 MB
- https://www.microsof...ls.aspx?id=9905
x64 version of MSRT:
File Name: Windows-KB890830-x64-V4.15.exe - 17.4 MB

.

Edited by AplusWebMaster, 12 December 2012 - 01:01 PM.

[AplusWebMaster]

FYI..

MS12-078 - "Known issues" ...
- http://support.micro....com/kb/2753842
Last Review: December 14, 2012 - Revision: 2.0
"Known issues with this security update: We are aware of issues related to OpenType Font (OTF) rendering in applications such as PowerPoint on affected versions of Windows that occur after this security update is applied. We are currently investigating these issues and will take appropriate action to address the known issues..."

- http://h-online.com/-1771419
18 Dec 2012 - "... this patch seems to prevent the correct display of PostScript Type 1 fonts and OpenType fonts. They disappear completely in a variety of applications – CorelDraw, QuarkExpress and PowerPoint – and currently the only way to make them visible again is to remove the patch..."

Edited by AplusWebMaster, 18 December 2012 - 09:14 PM.

[AplusWebMaster]

FYI...

MS12-078 re-released
- https://technet.micr...lletin/ms12-078
V2.0 (December 20, 2012): Re-released update KB2753842 to resolve an issue with OpenType fonts not properly rendering after the original update was installed. Customers who have successfully installed the original KB2753842 update need to install the rereleased update.
(Requires restart.)

- http://support.micro....com/kb/2753842
Dec 20, 2012 - Rev: 3.0
___

- http://h-online.com/-1773744
21 Dec 2012

- https://secunia.com/advisories/51459/
Last Update: 2012-12-21
Criticality level: Highly critical
CVE Reference(s):
- https://web.nvd.nist...d=CVE-2012-2556 - 9.3 (HIGH)
- https://web.nvd.nist...d=CVE-2012-4786 - 10.0 (HIGH)
Original Advisory: MS12-078 (KB2779030, KB2753842):
https://technet.micr...lletin/ms12-078

Edited by AplusWebMaster, 21 December 2012 - 02:45 PM.

[AplusWebMaster]

FYI...

Windows root certificate program members
- http://support.microsoft.com/kb/931125
12/21/2012 Revision Note: The KB 931125 package posted to Windows Update and WSUS on 12/11/2012 was intended only for client SKUs, but was also offered for Server SKUs. Since some customers reported issues after installing the package on Servers, the KB 931125 updates for Server SKUs were expired from Windows Update and WSUS. We recommend that you sync your WSUS server and approve the expiry. If you already applied the update and are encountering issues, please read the information below. If you need assistance recovering, please contact Microsoft Support. The automatic root update mechanism is enabled on Windows Server 2008 and later, but not on Windows Server 2003. Windows Server 2003 supports the automatic root update mechanism only partially, equivalent to the support on Windows XP. Since the root update package is intended for Windows XP client SKUs only, it is not intended for Windows Server SKUs. However, the root update package may be downloaded and installed on Windows Server SKUs, subject to the following restrictions... Server Administrators who install the root update package on Windows Server SKUs should make sure that the certificate count does not exceed the limits described in KB 931125 and KB 933430*. If you install the root update package on Windows Server SKUs, you may exceed the limit for how many root certificates that Schannel can handle when reporting the list of roots to clients in a TLS or SSL handshake, as the number of root certificates distributed in the root update package exceeds that limit. When you update root certificates, the size of the list of trusted CAs increases significantly, and the update may cause the list to grow too long. The list is then truncated and may cause problems with authorization..."

Clients cannot make connections if you require client certificates on a Web site or if you use IAS in Windows Server 2003
* http://support.microsoft.com/kb/933430
Last Review: Sep 11, 2011 - Revision: 6.0