Feeds

Five critical reasons to update Windows today

Patch Tuesday puts sysadmins on overtime

Security for virtualized datacentres

Microsoft has released six bulletins, five covering critical vulnerabilities, as part of its latest Patch Tuesday update.

The critical list includes flaws in Universal Plug and Play, Windows CSRSS, Microsoft Agent and Microsoft Content Management Server that create a means for hackers to inject code into vulnerable systems.

The security update follows last week's patch (MS07-017) for the ANI vulnerability, which Microsoft released early amidst reports of widespread hacking attacks targeting the flaw. Redmond also pushed out a hot-fix for this top priority patch designed to resolve conflicts with other applications. There's also an "important" patch designed to address a vulnerability in Windows Kernel that might allow privilege elevation.

Security vendors said Microsoft had done the right thing in releasing patches early, despite the application glitch problems. Alan Bentley, managing director of PatchLink EMEA, said: "Microsoft is becoming more adept at dealing with vulnerabilities by releasing key ones early, even when they are only a week before. It is also an indication that Microsoft is listening to its customers and responding to them rather than sticking to its own agenda."

Both the ANI vulnerability and CSRSS patch affect Windows Vista as well as other Windows operating systems, Bentley notes.

"Organisations need to take notice that although Vista is more secure, it is certainly not immune from vulnerabilities. PatchLink recommends that organisations prioritise deploying the Vista-related patches ASAP," he said.

"Since all five critical patches are for remote code execution, which is oftentimes a vehicle for botnets and other targeted attacks, it is essential that organisations remediate these vulnerabilities quickly."

Users are advised to update systems promptly. There's more information in Microsoft's security bulletin summary here and an advisory by security clearing house US CERT here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.