Feeds

Media Player and BEAST fix star in Patch Tuesday update

Roll up, roll up ... and upgrade already, chaps!

Secure remote control for conventional and virtual desktops

The first Patch Tuesday of 2012 rolled around with seven bulletins, including a postponed bulletin from December 2011 that plugs the BEAST SSL security flaw.

Only one of the seven vulnerabilities earns the dreaded critical rating – an update (MS12-004) that addresses two vulnerabilities in Windows Media Player: a critical bug involving MIDI playing and a lesser flaw involving closed caption (CC) interpretation. Both flaws might easily lend themselves to hacking attacks based on tricking punters into playing maliciously constructed media files.

Andrew Storms, director of security operations at nCircle, commented: "The Windows Media player bulletin for Windows Vista and XP should be the top deployment priority for everyone. The most significant bug in the bulletin can be exploited via a drive-by attacks, and that’s always a major concern.

"This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit," he added.

The other six bulletins deal with lesser (important) security fixes. One of these updates covers a new category in security flaw – called a security feature bypass – which relates to a flaw in the Microsoft C++ .NET compiler tool that produces binary code without security protections enabled. "This seems like it could be a cause for concern, but as of yet, there isn't any evidence that shows attackers are taking advantage of the loophole,” said Storms.

Microsoft's Patch Tuesday notice is here. A graphical overview from the SANS Institute's internet Storm Centre is here.

Adobe also released its quarterly update for Adobe Acrobat and Adobe Reader on Tuesday. The software developer released a roll-up update for Adobe Acrobat/Reader 9 and X users that addresses a number of critical vulnerabilities. The cross platform update also bundles fixes for two bugs in Acrobat/Reader 9 previously patched with out-of-band fixes last year. More details in Adobe's bulletin here. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.