Hotfixes, Patches and Updates – Oh My!

This has been a very busy week in the world of computer patching and updates. And we can’t just blame it on Microsoft.

Well – we can credit a huge share of upcoming patches to Microsoft. Next week on “Patch Tuesday” Redmond is releasing ten security patches for Windows, two for Office products, two non-security patches, and the regular Malicious Software Removal Tool release. In case you haven't been keeping track - that's over 30 new patches this summer alone!

Summary
=======
On 8 August 2006 Microsoft is planning to release:

Security Updates
. Ten Microsoft Security Bulletins affecting Microsoft Windows.
The highest Maximum Severity rating for these is Critical. These
updates will be detectable using the Microsoft Baseline Security
Analyzer and the Enterprise Scan Tool. Some of these updates will
require a restart.
. Two Microsoft Security Bulletins affecting Microsoft Office.
The highest Maximum Severity rating for these is Critical. These
updates will be detectable using the Microsoft Baseline Security
Analyzer. These updates may require a restart.

Microsoft Windows Malicious Software Removal Tool
. Microsoft will release an updated version of the Microsoft
Windows Malicious Software Removal Tool on Windows Update, Microsoft
Update, Windows Server Update Services and the Download Center.
Note that this tool will NOT be distributed using Software Update
Services (SUS).

Non-security High Priority updates on MU, WU, WSUS and SUS
. Microsoft will not release any NON-SECURITY High-Priority
Updates for Windows on Windows Update (WU) and Software Update
Services (SUS).
. Microsoft will release two NON-SECURITY High-Priority Updates
on Microsoft Update (MU) and Windows Server Update Services (WSUS).

Although we do not anticipate any changes, the number of bulletins,
products affected, restart information and severities are subject to
change until released.


Can’t let Microsoft have all the fun. The Firefox browser people have released yet another update for their ever-growing-in-popularity browser. This makes two updates in as many weeks.

Mozilla has released version 1.5.0.6 of Firefox, approximately 1 week after releasing version 1.5.0.5. This release addresses an issue with playing windows media content in the Firefox browser. More information
here: http://www.mozilla.com/firefox/releases/1.5.0.6.html


McAfee has released an update for their security center products:

McAfee has released a patch for Security Center products including:
antispyware, internet security suite, personal firewall plus, privacy service, quickclean, spamkiller, virusscan, and wireless home network security. Description of the issue from McAfee:

"This attack requires the consumer to perform certain actions in order to be exploited. For example receiving an e-mail from an un-trusted source and clicking on a malicious URL. McAfee suggests that a consumer not click on any URLs in an email that comes from an unknown or non-trusted source. A successful exploit of the security flaw would allow an attacker to remotely execute arbitrary code on the machine running the indicated software. These arbitrary commands would be limited to the privileges of the user which the product is running as on the machine. In order to accomplish this exploit, a user would have to force internet explorer to render a malicious web page which has been generated by the attacker. The attack requires reverse engineering of the software as well as the assistance of the user."

More information in their security bulletin here:
http://ts.mcafeehelp.com/faq3.asp?docid=407052


And finally, if you have a laptop (or other computer) that uses the Intel/PRO series of wireless chipsets, your drivers are likely to be vulnerable to attack. Follow the links below to find the correct driver download for your affected products.

This is not going to be fun or easy to fix. On 8/1 Intel released information about wireless driver and proset software vulnerabilities which affect the 2100 and 2200 Intel wireless components which are in every single Dell laptop we have. The driver vulnerabilities are critical and can be used to take over full control of a machine. Details at:
http://support.intel.com/support/wireless/wlan/sb/CS-023068.htm

Anyone doubting their criticality should read:
http://www.theregister.com/2006/08/03/wifi_driver_hack/
It is recommended by Intel that users check with their manufacturer (Dell) to see if they are going to release their own version of the drivers since manufacturers have the option of making changes which could cause problems with the Intel OEM drivers. I checked Dell's website and as of today they don't have a new version so communication needs to be made with Dell to determine if and when they will be releasing new ones, and if they aren't, whether their will be any problems with the OEM drivers.

Happy patching, folks. Be sure to test these patches and patch quickly.