Original URL: http://www.theregister.co.uk/2012/01/11/patch_tuesday/
Media Player and BEAST fix star in Patch Tuesday update
Roll up, roll up ... and upgrade already, chaps!
The first Patch Tuesday of 2012 rolled around with seven bulletins, including a postponed bulletin from December 2011 that plugs the BEAST SSL security flaw.
Only one of the seven vulnerabilities earns the dreaded critical rating – an update (MS12-004) that addresses two vulnerabilities in Windows Media Player: a critical bug involving MIDI playing and a lesser flaw involving closed caption (CC) interpretation. Both flaws might easily lend themselves to hacking attacks based on tricking punters into playing maliciously constructed media files.
Andrew Storms, director of security operations at nCircle, commented: "The Windows Media player bulletin for Windows Vista and XP should be the top deployment priority for everyone. The most significant bug in the bulletin can be exploited via a drive-by attacks, and that’s always a major concern.
"This bulletin provides yet another reason to upgrade to Windows 7 because those users are not affected by this drive-by exploit," he added.
The other six bulletins deal with lesser (important) security fixes. One of these updates covers a new category in security flaw – called a security feature bypass – which relates to a flaw in the Microsoft C++ .NET compiler tool that produces binary code without security protections enabled. "This seems like it could be a cause for concern, but as of yet, there isn't any evidence that shows attackers are taking advantage of the loophole,” said Storms.
Adobe also released its quarterly update for Adobe Acrobat and Adobe Reader on Tuesday. The software developer released a roll-up update for Adobe Acrobat/Reader 9 and X users that addresses a number of critical vulnerabilities. The cross platform update also bundles fixes for two bugs in Acrobat/Reader 9 previously patched with out-of-band fixes last year. More details in Adobe's bulletin here. ®