Feeds

Media Player and BEAST fix star in Patch Tuesday update

Roll up, roll up ... and upgrade already, chaps!

Secure remote control for conventional and virtual desktops

The first Patch Tuesday of 2012 rolled around with seven bulletins, including a postponed bulletin from December 2011 that plugs the BEAST SSL security flaw.

Only one of the seven vulnerabilities earns the dreaded critical rating – an update (MS12-004) that addresses two vulnerabilities in Windows Media Player: a critical bug involving MIDI playing and a lesser flaw involving closed caption (CC) interpretation. Both flaws might easily lend themselves to hacking attacks based on tricking punters into playing maliciously constructed media files.

Andrew Storms, director of security operations at nCircle, commented: "The Windows Media player bulletin for Windows Vista and XP should be the top deployment priority for everyone. The most significant bug in the bulletin can be exploited via a drive-by attacks, and that’s always a major concern.

"This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit," he added.

The other six bulletins deal with lesser (important) security fixes. One of these updates covers a new category in security flaw – called a security feature bypass – which relates to a flaw in the Microsoft C++ .NET compiler tool that produces binary code without security protections enabled. "This seems like it could be a cause for concern, but as of yet, there isn't any evidence that shows attackers are taking advantage of the loophole,” said Storms.

Microsoft's Patch Tuesday notice is here. A graphical overview from the SANS Institute's internet Storm Centre is here.

Adobe also released its quarterly update for Adobe Acrobat and Adobe Reader on Tuesday. The software developer released a roll-up update for Adobe Acrobat/Reader 9 and X users that addresses a number of critical vulnerabilities. The cross platform update also bundles fixes for two bugs in Acrobat/Reader 9 previously patched with out-of-band fixes last year. More details in Adobe's bulletin here. ®

New hybrid storage solutions

More from The Register

next story
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
Keep that consumer browser tat away from our software says Oracle
Big Red decides it will only support Firefox's Extended Support Releases
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
WordPress 4.0 is here, complete with one-click upgrade process
Don't relax yet, sysadmins, there's still a chance for some big messes here
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.