Microsoft

Since 2003, the number of exploitable vulnerabilities has fallen considerably in Microsoft’s Office suite. H-Online: Independently of each other, security specialists Dan Kaminsky and Will Dormann from Carnegie Mellon University’s CERT have found that, in the past few years, the number of flaws and exploitable vulnerabilities in individual versions of Microsoft Office has fallen dramatically, achieving results that are even below those ofOpenOffice. However, their findings should be treated with caution, as they are based on automatic evaluations and say little about the actual threat potential. ...

On its recent patch day, Microsoft released security updates to fix vulnerabilities in multiple versions of its Office products. The patch for PowerPoint 2003 can, however, have negative consequences – after installation existing presentations may be unable to be opened or may cause an error message stating that the file is corrupted and cannot be fully displayed. In the latter case, the content of the presentation can only be partially read and any non-displayed elements, in particular background images, are lost for good after saving. ...

Fulfilling the hints Microsoft dropped back in March, the Redmond software company unveiled the first platform preview of Internet Explorer 10 at MIX 11 in Las Vegas on Tuesday. This first preview of Internet Explorer 10 builds on the big HTML5 push that began with IE9, and adds support for more advanced Web standards, such as CSS3 Gradients as background images, and CSS3 Flexible Box and multi-column layout. Microsoft said code refreshes will take place approximately every twelve weeks for IE10. ...

Google Operation System Blog: I tried to download the latest Chromium build using Internet Explorer 9 and it was one of the most painful downloading experiences. Microsoft tries to protect users from downloading malware and uses a feature called SmartScreen Filter that “checks software downloads against a dynamically updated list of reported malicious software sites”. This feature was available in IE8, but the latest version of IE tried to improve it by analyzing application reputation. ...

isc.sans.edu: Microsoft released version 9 of its Internet Explorer web browser. You can download IE 9 from windows.microsoft.com. Microsoft also set up a domain dedicated to the new browser: www.beautyoftheweb.com. Unfortunately, that site isn’t hosted under the microsoft.com domain, nor does it have an SSL certificate to confirm that it belongs to Microsoft. Using this site to distribute the browser goes against the advice of downloading software only from known vendor websites. Copycat malicious sites claiming to distribute IE 9 will probably appear shortly, if they aren’t around yet. ...

Sophos Labs Blog: If you’re interested in computer security, you’ve probably heard of PWN2OWN. It’s a competition which has become an annual fixture at the annual CanSecWest conference in Vancouver, British Columbia. The competition gets its name because, as the CanSecWest organizers explain, “If you can execute arbitrary code (PWN) on these [laptops or mobile phones] through a previously undisclosed browser (Firefox, IE, Safari) exploit, you can go home with one (OWN).” ...

BetaNews wrote: Thursday, Microsoft announced two updates to its Software Assurance Desktop Optimization Pack for enterprise Windows deployments available immediately: App-V 4.6 SP1, and MED-V 2.0. Microsoft Application Virtualization, or App-V, is the solution which turns software applications into centrally managed, virtualized services that don’t have to be installed on client machines. With the SP1 update, Microsoft has introduced package accelerators in the new App-V Sequencer, which Microsoft has been discussing since mid-2010. Package Accelerators are files that admins can combine with install media to automatically convert applications into virtual packages. They are released 1:1 with the applications they work with, and the first accelerators will be available in early April, and will include Project, Adobe Reader, and Office 2010. ...

TechSpot Wrote: A few new Windows 8 user interface screenshots have leaked. Windows 8 build 7910 is part of the Milestone 2 branch, so we’re not seeing the latest, but it is rather interesting that it took just eight minutes to install, approximately 2.5 times faster than Windows 7. You have to thank the Chinese website Win7China for offering a glimpse into the future even though the leaks did include several wallpapers with a “ssh…let’s not leak our hard work” message. ...

http://windowsteamblog.com: Today we officially handed off the final release (RTM) of Windows 7 and Windows Server 2008 R2 Service Pack 1 (SP1) to our OEM partners. On February 16th Windows 7 and Windows Server 2008 R2 SP1 will be available for MSDN and TechNet Subscribers as well as Volume License customers. On February 22nd, Windows 7 and Windows Server 2008 R2 SP1 will become generally available for folks to download via the Microsoft Download Center and available on Windows Update. ...

Before IE developers held a press conference in San Francisco to unveil the RC version of IE 9 this morning, Microsoft has released the RC for download here (x86) and here (x64). As expected, the release candidate includes much improved tab functionality, from the new square-ish visual elements, and moveable tab bar elements to increase customization. It also includes features that enable a user to refuse tracking from advertisers. It also promises to fix a number of remaining bugs and minor annoyances that plagued the Beta and developer previews of the browser. The newer, more stable version of the browser needs to be pretty picture perfect if MS wants to regain its market share lost to Chrome and Firefox since IE8 started faltering. ...

MSDN Blog: On Tuesday, December 14, we released an update (KB2412171) for Microsoft Outlook 2007. We have discovered several issues with the update and want to inform you about problems you might encounter and what corrective steps we recommend. As of December 16, this Outlook 2007 update has been removed from Microsoft Update. This Outlook 2007 update was distributed via Microsoft Update. Many of you receive updates automatically and if you installed the update between Tuesday, December 14, and Thursday, December 16, it is likely that you are affected. ...

As announced Friday last week, Microsoft delivers 17 security updates on the December 2010 Patchday. The Updates close 2 highly critical security holes which allow for remote code execution and several privilege escalation vulnerabilities that allow attackers to gain administrative rights on Windows PCs. Overall, the 17 Updates deal with 40 vulnerabilities. Affected are the Windows operating Systems, Internet Explorer, Microsoft Office, SharePoint and Exchange. Users and administrators should apply the patches as soon as possible!

Avira TechBlog: Next Tuesday is going to be tough for administrators: The Redmond company announces 17 security bulletins which are supposed to fix 40 security vulnerabilities. Only two of the bulletins deal with “high”ly critical rated security holes within Windows and the Internet Explorer. The rest of the updates fixes the Windows operating systems, Microsoft’s Office, SharePoint and Exchange.

Mashable: Windows Phone 7 has been on the market for a little more than a month, but the company still isn’t disclosing how many devices featuring its revamped mobile OS have been sold. Pressed on the issue by The Wall Street Journal’s Walt Mossberg at All Things Digital’s D: Dive Into Mobile conference on Tuesday, Microsoft Corporate VP for Windows Phone Joe Belfiore would say only that “It’s just too soon to talk about numbers,” though he admitted it will likely take years before Microsoft is near the top of the mobile market share discussion. ...

The Register: Windows source code tapped, say WikiLeaked docs The Chinese government may have used its access to Microsoft source code to develop attacks that exploited weaknesses in the Windows operating system, according to a US diplomatic memo recently published by WikiLeaks. The June 29, 2009 diplomatic cable claims that a Chinese security firm with close ties to the People’s Republic of China, got access to the Windows source under a 2003 agreement designed to help companies improve the security of the Microsoft operating system. Topsec allegedly worked with a government organization known as CNITSEC, short for the China Information Technology Security Center, which actively worked with “private sector” hackers to develop exploits. ...