Vulnerabilities

Since moving to a monthly schedule in October 2003, Microsoft has released about 400 security bulletins based on an informal count of releases in its bulletin archives. The bulletins address about 745 vulnerabilities across almost every Microsoft product.
About 230, or more than half of the bulletins, addressed security vulnerabilities that were described by Microsoft as “critical.” This definition is what Microsoft typically uses for vulnerabilities that allow attackers to take full administrative control of a system from a remote location. Read the full story [Jaikumar Vijayan/Computerworld]

Computerworld’s Gregg Keizer brings word that this week’s record-setting batch of patches from Microsoft actually closed the book on the vexing ATL code library issues that first surfaced in July 2009.
Keizer quotes Ryan Smith, one of the hackers credited with discovering the flaw, as saying that the latest Microsoft Office updates shut the door on the last big attack vector for the ATL vulnerability.  Read the full story [computerworld.com]

Botnets have become a major problem in the last few years, with massive networks such as Storm, Nugache and others comprising hundreds of thousands of infected machines. This video lays out the foundation of the problem and explains the efforts of researchers to take over the Torpig botnet.

By Jason Miller
Microsoft has released 13 new security bulletins in the October 2009 version of Patch Tuesday.  Eight bulletins have a severity rating of Critical. The remaining five security bulletins have a severity rating of Important. For the first time, Windows 7 and Windows 2008 R2 are affected by security bulletins. The sheer volume of bulletins and subsequent patches this month will likely give administrator fits.

Antispam vendors, browser makers and Internet service providers have been on the front lines in the battle to contain phishing attacks, but the cybercriminals behind phishing campaigns are getting savvy at defeating technologies and tricking victims into giving up their credentials and other data. Read the full story [SearchSecurity.com].

On the same day that Microsoft unleashed a torrent of 34 patches on its customer base, Adobe on Tuesday published patches for 29 vulnerabilities in its Acrobat and Reader products as part of its new quarterly patch release program.

Microsoft today released its largest ever batch of Patch Tuesday updates to fix a whopping 34 security holes in a wide range of widely deployed software products.
The latest patch batch covers critical vulnerabilities in software products that are bundled with Microsoft’s dominant Windows operating system (Internet Explorer and Windows Media Player) — and several known security problems (SMB v2 and FTP in IIS) for which functioning exploit code has already been publicly released.