Feeds

Media Player and BEAST fix star in Patch Tuesday update

Roll up, roll up ... and upgrade already, chaps!

Choosing a cloud hosting partner with confidence

The first Patch Tuesday of 2012 rolled around with seven bulletins, including a postponed bulletin from December 2011 that plugs the BEAST SSL security flaw.

Only one of the seven vulnerabilities earns the dreaded critical rating – an update (MS12-004) that addresses two vulnerabilities in Windows Media Player: a critical bug involving MIDI playing and a lesser flaw involving closed caption (CC) interpretation. Both flaws might easily lend themselves to hacking attacks based on tricking punters into playing maliciously constructed media files.

Andrew Storms, director of security operations at nCircle, commented: "The Windows Media player bulletin for Windows Vista and XP should be the top deployment priority for everyone. The most significant bug in the bulletin can be exploited via a drive-by attacks, and that’s always a major concern.

"This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit," he added.

The other six bulletins deal with lesser (important) security fixes. One of these updates covers a new category in security flaw – called a security feature bypass – which relates to a flaw in the Microsoft C++ .NET compiler tool that produces binary code without security protections enabled. "This seems like it could be a cause for concern, but as of yet, there isn't any evidence that shows attackers are taking advantage of the loophole,” said Storms.

Microsoft's Patch Tuesday notice is here. A graphical overview from the SANS Institute's internet Storm Centre is here.

Adobe also released its quarterly update for Adobe Acrobat and Adobe Reader on Tuesday. The software developer released a roll-up update for Adobe Acrobat/Reader 9 and X users that addresses a number of critical vulnerabilities. The cross platform update also bundles fixes for two bugs in Acrobat/Reader 9 previously patched with out-of-band fixes last year. More details in Adobe's bulletin here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Post-Microsoft, post-PC programming: The portable REVOLUTION
Code jockeys: count up and grab your fabulous tablets
Twitter App Graph exposes smartphone spyware feature
You don't want everyone to compile app lists from your fondleware? BAD LUCK
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.