DrJBHL DrJBHL

Huge “Patch Tuesday” Coming–17 Bulletins–64 Vulnerabilities Addressed

▼

Huge “Patch Tuesday” Coming–17 Bulletins–64 Vulnerabilities Addressed

from JoeUser Forums

A really HUGE Update is coming on Tuesday!

17  patches are coming: 8 rated “Critical” and 9 rated “Important” with fixes for 64 documented vulnerabilities across Microsoft Windows, Microsoft Office, Internet Explorer, Visual Studio, .NET Framework and GDI+.

From Pete Voss’s Technet Blog:

 

“This month we'll be closing some issues that Microsoft has already previously spoken to, including the SMB Browser (Critical) issue publicly disclosed Feb. 15. Microsoft assessed the situation and reported that although the vulnerability could theoretically allow Remote Code Execution, that was extremely unlikely.  To this day, we have seen no evidence of attacks.

We are also planning a fix for the MHTML vulnerability in Windows, rated Important. We alerted people to this issue with Security Advisory 2501696 (including a Fix-It that fully protected customers once downloaded) back in late January. In March, we updated the advisory to let people know we were aware of limited, targeted attacks.

The bulletin release scheduled for the second Tuesday of the month, April 12, at approximately 10 a.m. PDT.”

Voss didn’t address the vulnerabilities discovered in the “Pwn2Own” contest.

People, please get the updates and patches. Also, please update your Programs: Stardock’s, and others…. This is an important key to your security, and a fast, reliable computer.

118,842 views 81 replies
Reply #51 from GalCiv2 Forums Top

An anti-virus product is not guaranteed to protect you against 'Oh this site only looks kind of dodgy, click' though. :P

 

Reply #52 from WinCustomize Forums Top

Quoting kona0197, reply 49
I woould use MSE except there is no option to turn off the auto updates. When installed it turns on Windows auto updates. Unacceptable.
End of kona0197's quote

BS...it does not turn on Windows auto updates.

I run MSE and besides virus definition updates, all other updates can be set to manual. Also, when installed MSE, it does not change your widows updates settings.

Where ever you are getting your info from about this, they are wrong.

TouchTasks - Access tasks with ease on Windows touchscreens.
Reply #53 from WinCustomize Forums Top

Quoting DrJBHL, reply 50
Sorry, kona but no. Not in this world. Norton has been rated the best, and trades off with Kaspersky for that depending which review you read, and which testing done. But AVG isn't number one (unless you mean among the freewares).
End of DrJBHL's quote

There was a report that Jafo posted (think it was him) that shows where the AV programs rank. AVG was ranked higher than any pay for versions. Norton and McAfee are both far more bloated than AVG. They do this test every year.

Reply #54 from WinCustomize Forums Top

Quoting CarGuy1, reply 52
BS...it does not turn on Windows auto updates.
End of CarGuy1's quote

Yes it does. I had my system set to off for auto updates. I installed MSE to try it and it turned the Windows auto updates to on. Try it. It will do the same on your system.

From: http://www.infoworld.com/t/anti-virus/warning-microsoft-security-essentials-installer-zaps-automatic-updates-setting-804

"There's just one little problem. If you've switched Microsoft Update or Windows Update to "Notify but don't download" or "Download but don't install," running the MSE installer zaps out your setting and switches Windows over to Automatic Updates. More to the point, the MSE installer does its little bit of mischief without warning or notification and without asking for permission."

Google the issue. Plenty of people have this issue with MSE.

Reply #55 from WinCustomize Forums Top

For free: Ad-Aware 9

For Pay: Kaspersky (beware 2 week renewal renewal)

Reply #56 from WinCustomize Forums Top

Quoting kona0197, reply 29
my updates automatically even though I stopped 7's SP1 with SP's I wait and Hide to see if others PC's get Screwed then if all is good I pounce on them

No one in their right mind should enable auto updates. Good way to let MS get inside your machine with WGA stuff.
End of kona0197's quote

 

well then I just isn't in my right mind,,, Mama always said, you never know what's in a update till you bit into it....

Reply #57 from Elemental Forums Top

Quoting inthebloodofeden, reply 6

Besides,I want to tell one thing more:please,download Secunia PSI http://secunia.com/vulnerability_scanning/personal/ ,that scan your PC and inform you about any software and plugin vulnerabilities,O.S.missing security patches,browsers vulnerabilities,end-of-life progs (no more supported)elements(please NOTE,all end-of-life progs elements are potential vulnerabilities,and needs to be deleted from the system),and tell you all the steps to get the needed patches,if available.,by Secunia PSI itself.
End of inthebloodofeden's quote

 

I used the onlinescan and it found quite a few outdated programs.

 

SUN JAVA JRE has two versions installed now....doesn't it uninstall older versions itself??       Strange program. No update available....

Quicktime (which I only installed to view some video thing)

ActiveX 10...Flashplayer I think...

 

Deleting End of Life programs is just paranoid. Does that include freeware and old games as well?

Reply #58 from WinCustomize Forums Top

Quoting Uvah, reply 28
Just recently installed SP1 on Win7 Pro. Took 90 minutes this time around. On Home premium it took just under an hour. It was the day room I was at this time. Before it was sitting in Starbucks enjoying a very large Pike's Place. Good stuff.
End of Uvah's quote

I wonder what system you have it sounds like it is having a hard time to run WIN7... While i think of earlier posts you made and had problems with several things.

BTW you should try to buy CS5 over ebay its cheaper but still expansive.I had the pleasure to buy it over a closing company but i also payd around 350 Euros.

Quoting DrJBHL, reply 55
For free: Ad-Aware 9
For Pay: Kaspersky (beware 2 week renewal renewal)
End of DrJBHL's quote


Freeware protection : "Antivira combined with Adaware" unbeatable i wonder when they will merge :P
For Pay : Ad-Aware Proffesional combines with any Anti-virus software of your choice.

Reply #59 from WinCustomize Forums Top

Was talking about single apps. Not combinations. Yours will work.

Just do the updates... things have gotten far OT from there. 

Reply #60 from Stardock Forums Top

Quoting Campaigner, reply 57
SUN JAVA JRE has two versions installed now....doesn't it uninstall older versions itself??       Strange program. No update available....
End of Campaigner's quote

Likely something installed a second copy without detecting what was already there, and now the updates only apply to one of them.

Reply #61 from JoeUser Forums Top

I got the sneak peak of the bug fixes (I am on that MS list).  And was flummoxed! I am glad MS is fixing all of them, and still marvel that so many still get through.  I understand that the millions of lines of code are hard to debug, but what are the QA people getting paid to do?  I guess the immediacy of needing to get things out the door still trumps the QA.

Reply #62 from WinCustomize Forums Top

Quoting Campaigner, reply 57


I used the onlinescan and it found quite a few outdated programs.

 
SUN JAVA JRE has two versions installed now....doesn't it uninstall older versions itself??       Strange program. No update available....

Quicktime (which I only installed to view some video thing)

ActiveX 10...Flashplayer I think...

 
Deleting End of Life programs is just paranoid. Does that include freeware and old games as well?
End of Campaigner's quote

Well,just a few things:

1)If the online scan detected a few outdated progs,it's better to download PSI and make a full scan(online one is partial).

2)About Java:is good to know that is NECESSARY to uninstall the running JAVA before installing the updated version.The new version,with fixed vulnerabilities,is just "added" to the old one,but doesn't fix his vulnerabilities.So,the best thing to do is to unistall all JAVA progs,cleaning the registry(CCleaner,Wise Registry Cleaner..),and then install the last version(Update 24).

3)About other outdated progs,if you check,PSI itself will show you the available updates.

4)Hackers knows about end-of-life progs,making specific searches.These progs are no more supported,so it can be easy to release a virus or malware to attack them(mostly it depends from their popularity;more people are using them,higher is the risk),and there will be no any patch from vendors.In short:only hackers are "WORKING" on end-of-life progs,no vendors anymore.

 

Reply #63 from WinCustomize Forums Top

One thing with Secunia PSI is that with some things...even after it tells you there is an update...and you install the update...and then do a scan again...it comes up as not being updated again...gets annoying.

 

Quoting kona0197, reply 53
Norton and McAfee are both far more bloated than AVG.
End of kona0197's quote

I never understand this...I've used Norton for the last 8 years and have never seen any bloat on my pc...in fact I don't even know it's installed half the time.

Reply #64 from WinCustomize Forums Top

Ask Jafo about Norton and it's problems WebGizmos.

Reply #65 from WinCustomize Forums Top

Quoting inthebloodofeden, reply 62
only hackers are "WORKING" on end-of-life progs,no vendors anymore.
End of inthebloodofeden's quote

Yeah ...... but after awhile you learn not to do certain things. Like when I'm working in PS its usually when I'm not online with the WLAN turned off. If the doors closed they can't get in and don't say there are always 'Windows' either. lol

Reply #66 from WinCustomize Forums Top

Quoting kona0197, reply 64
Ask Jafo about Norton and it's problems WebGizmos.
End of kona0197's quote

Don't have to....works just fine for me. ;)

Reply #67 from WinCustomize Forums Top

Quoting WebGizmos, reply 63
I never understand this...I've used Norton for the last 8 years and have never seen any bloat on my pc...in fact I don't even know it's installed half the time.
End of WebGizmos's quote

Web....yes, 8 years of bliss.

My [and millions of others'] dramas were with Norton2002 [9 years] as/when it disabled MS BITS efficiently preventing Windows Updates.

The 'cure' was a choice of very extensive registry hacking and dll replacements OR the PHYSICAL reinstall of SP1 [or 2...can't recall which].

Note 'physical' as with BITS screwed you weren't gonna get it as an online update.

The NEXT step was to permanently AVOID anything 'Norton'.

Now, Kaspersky simply WORKS as it [or any AV/wall] SHOULD....;)

Reply #68 from WinCustomize Forums Top

Quoting Gwenio1, reply 60



Quoting Campaigner,
reply 57
SUN JAVA JRE has two versions installed now....doesn't it uninstall older versions itself??       Strange program. No update available....


Likely something installed a second copy without detecting what was already there, and now the updates only apply to one of them.
End of Gwenio1's quote

Just FYI there is a 32 bit Java and a 64 bit Java. Some programs need one or the other. Could be why you are seeing two versions!:meow:

Reply #69 from WinCustomize Forums Top

Quoting Uvah, reply 65


Yeah ...... but after awhile you learn not to do certain things. Like when I'm working in PS its usually when I'm not online with the WLAN turned off. If the doors closed they can't get in and don't say there are always 'Windows' either. lol
End of Uvah's quote

Correct;of course that's a good way to be safe.Or,if you have Kaspersky Internet Security installed on your machine,you can open PS in Kaspersky "Safe Run for Applications" mode.Same for IE8;just now,I'm using IE8 in Kaspersky "Safe Run for Websites" mode(best thing ever).

Quoting Frankief, reply 68


Just FYI there is a 32 bit Java and a 64 bit Java. Some programs need one or the other. Could be why you are seeing two versions!
End of Frankief's quote

I don't think Campaigner was talking about this kind of issue(x32/x64 versions).He mentioned OLDER VERSIONS(very common issue with Java!)

Main point is this:when you install a Java update,the new version it's just ADDED to the older one,is not REPLACING it.That's the way Java works.Of course progs will use the updated version,but the previous one vulnerabilities are still in the system,a possible "target" for hackers(besides,Java is a very popular application).So,a good rule is to manually uninstall the running Java before installing the new version.

Reply #70 from WinCustomize Forums Top

Quoting inthebloodofeden, reply 69
Main point is this:when you install a Java update,the new version it's just ADDED to the older one,is not REPLACING it.That's the way Java works.Of course progs will use the updated version,but the previous one vulnerabilities are still in the system,a possible "target" for hackers(besides,Java is a very popular application).So,a good rule is to manually uninstall the running Java before installing the new version.
End of inthebloodofeden's quote

Good advice I think. Never knew that Java did the ad-on rather than overlay thing. I always thought, like some apps, a little house keeping, would be in order. you know like clean out what's being replaced. Going to keep this in mind for the next one.

Reply #71 from JoeUser Forums Top

Quoting Jafo, reply 67

My [and millions of others'] dramas were with Norton2002 [9 years] as/when it disabled MS BITS efficiently preventing Windows Updates.

The 'cure' was a choice of very extensive registry hacking and dll replacements OR the PHYSICAL reinstall of SP1 [or 2...can't recall which].

Note 'physical' as with BITS screwed you weren't gonna get it as an online update.

The NEXT step was to permanently AVOID anything 'Norton'.

Now, Kaspersky simply WORKS as it [or any AV/wall] SHOULD....
End of Jafo's quote

Count me in as one of the millions you speak of.  Although I am open to giving them another chance now (just not for pay - if they want to give me a free trial, I will accept the challenge).

Reply #72 from WinCustomize Forums Top

You said there would be many updates to install. I checked this morning. Only one for me and it was for Windows Defender.

Reply #73 from WinCustomize Forums Top

The bulletin release scheduled for the second Tuesday of the month, April 12, at approximately 10 a.m. PDT.”
End of quote

Kona0197 I don't think the updates are available yet.

Reply #74 from WinCustomize Forums Top

Available at noon, per Voss's blog.

Reply #75 from WinCustomize Forums Top

Downloading updates now.  :sun: