Feeds

Patch Tuesday sounds death knell for Win XP SP2

Hasta la vista

Intelligent flash storage arrays

Microsoft released the expected four security advisories on Tuesday, three of which earn the dread rating of critical. They collectively address five security vulnerabilities.

There are two critical fixes for Windows in the batch, including an update designed to resolve a zero-day vulnerability involving Windows Help and Support Centre that's become a hackers' favourite over recent weeks. The vulnerability was controversially disclosed by Google staffer Tavis Ormandy prior to Microsoft providing a fix.

The other two critical updates cover flaws in Microsoft Access ActiveX component and the CDD display driver for Windows 7 and Windows 2008R2. Lesser risk "important" updates cover security bugs in the handling of attachments by Microsoft Outlook.

Tyler Reguly, senior security engineer at security firm nCircle, described July's patches as "pretty mundane" in terms of corporate security.

"The most interesting vulnerability for the enterprise is MS10-045, which lets an attacker use a specially-crafted UNC path in an Outlook attachment to bypass Outlook’s warning about opening potentially malicious attachments," Reguly said. "This is significant because Operation Aurora and other high profile email based attacks over the last year have proven to be highly successful."

The Internet Storm Centre has once again put together a handy overview of Microsoft's latest Patch Tuesday update here. Microsoft's bulletin is here.

July 2010's Patch Tuesday marked the last month Microsoft will issue patches for either Windows XP Service Pack 2 and Win 2000. Security watchers reckon a significant proportion of Windows machines are still running Win XP SP2.

"Since Windows XP is still the most popular OS version for Windows, I believe we’re dealing with hundreds of millions of Windows XP SP2 systems that need to be upgraded," said Wolfgang Kandek, CTO of Qualys. "Our own monitoring shows that roughly 50 percent of all XP machines still run on the SP2 version. XP SP2 machines can be found both in corporate installations and are also very often the OS on home machines." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
First in line to order a Nexus 6? AT&T has a BRICK for you
Black Screen of Death plagues early Google-mobe batch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.