Feeds

Patch Tuesday sounds death knell for Win XP SP2

Hasta la vista

Secure remote control for conventional and virtual desktops

Microsoft released the expected four security advisories on Tuesday, three of which earn the dread rating of critical. They collectively address five security vulnerabilities.

There are two critical fixes for Windows in the batch, including an update designed to resolve a zero-day vulnerability involving Windows Help and Support Centre that's become a hackers' favourite over recent weeks. The vulnerability was controversially disclosed by Google staffer Tavis Ormandy prior to Microsoft providing a fix.

The other two critical updates cover flaws in Microsoft Access ActiveX component and the CDD display driver for Windows 7 and Windows 2008R2. Lesser risk "important" updates cover security bugs in the handling of attachments by Microsoft Outlook.

Tyler Reguly, senior security engineer at security firm nCircle, described July's patches as "pretty mundane" in terms of corporate security.

"The most interesting vulnerability for the enterprise is MS10-045, which lets an attacker use a specially-crafted UNC path in an Outlook attachment to bypass Outlook’s warning about opening potentially malicious attachments," Reguly said. "This is significant because Operation Aurora and other high profile email based attacks over the last year have proven to be highly successful."

The Internet Storm Centre has once again put together a handy overview of Microsoft's latest Patch Tuesday update here. Microsoft's bulletin is here.

July 2010's Patch Tuesday marked the last month Microsoft will issue patches for either Windows XP Service Pack 2 and Win 2000. Security watchers reckon a significant proportion of Windows machines are still running Win XP SP2.

"Since Windows XP is still the most popular OS version for Windows, I believe we’re dealing with hundreds of millions of Windows XP SP2 systems that need to be upgraded," said Wolfgang Kandek, CTO of Qualys. "Our own monitoring shows that roughly 50 percent of all XP machines still run on the SP2 version. XP SP2 machines can be found both in corporate installations and are also very often the OS on home machines." ®

Beginner's guide to SSL certificates

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
HTML5 vs native: Harry Coder and the mudblood mobile app princes
Developers just want their ideas to generate money
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.