Microsoft

As expected, Microsoft has pushed out a mandatory update to the Xbox 360 today, which adds support for USB storage devices, expanding the memory capacity of the five-year old video game console. The update will ostensibly allow any FAT32-formatted USB storage device between 1GB-16GB in size to be used to save profiles, game saves, and downloadable content. There are, however, a number of caveats, which mean users can’t just plug anything in and have it work. ...

Tom Gallagher, senior security test lead with Microsoft’s Trustworthy Computing group, was extensively quoted in news stories today as he described how his group found 1,800 software flaws in Office 2010 by running millions of “fuzzing” tests. According to ComputerWorld, “Microsoft was able to find such a large number of bugs in Office 2010 by using not only machines in the company’s labs, but also under-utilitized or idle PCs throughout the company. The concept isn’t new: The Search for Extraterrestrial Intelligence (SETI@home) project may have been the first to popularize the practice, and remains the largest, but it’s also been used to crunch numbers in medical research and to find the world’s largest prime number. ...

There’s at least one company that isn’t scrambling to get an iPad app ready for launch day, and that company is Microsoft. Stephen Elop, president of Microsoft’s business division, said in an interview with Bloomberg that the company will “wait and see” how iPad sales perform before adapting Microsoft Office 2010 for the device. “We never say never, but we have no current plans [to develop a version of Office for the iPad],” Elop claimed. ...

MS10–018 If you’re using Internet Explorer versions 6 or 7 it wouldn’t be a good idea to miss this one. “Actively exploited” for drive by down loads from malicious web sites sums it up. There’s something in it for IE8 as well. See our post yesterday: “Microsoft out-of-band patch tomorrow”

Microsoft said today it will issue an out-of-band patch tomorrow for a vulnerability in Internet Explorer 6 and 7 that is being actively exploited. “The vulnerability exists due to an invalid pointer reference being used within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution,” Microsoft said in its Security Advisory 981374 earlier this month. ...

Last month, Microsoft sent flowers to a mock funeral for Internet Explorer 6, in a show of support for the ideal that the old browser should be declared defunct worldwide. But for a few years yet, the company is still bound to support the product for those users (generally businesses) who refuse to upgrade it. That’s why new exploits that continue to target old browsers, such as IE6 and IE7, continue to get attention even a full year after the proper security fix — IE8 — has been deployed. ...

We’ve previously listed many official themes for Windows 7, presented by Microsoft at Windows 7 Personalization Gallery. Here are 2 more new themes which truly depicts the prominent beauty of Taiwanese mountains ‘Syue & Nenggao’ in Taiwan. Syue or Hsuehshan or Snow Mountain is the second highest mountain in Taiwan with its main peak at 3,886 m (12,749 ft) above sea level. Nenggao is a mountain in Taiwan whose southern peak has an elevation of 3,349 m. Its main peak lies at 3,261 m. ...

For the current vulnerability in Internet Explorer 6 and 7 which already gets actively exploited on the net, Microsoft is already testing a patch. The company is still considering whether to release the patch on the regular Patchday or out-of-band. Meanwhile, a “Fix-it”-solution is available. With some registry changes the affected peers factory in iepeers.dll gets disabled by a mouse click. You can download it from Microsoft’s knowledgebase.

A little more than a week ago Microsoft started delivering a new Browser Choice for Windows to be compliant to the European Union law. There are plenty of web browsers to choose from, and my colleague Sorin Mustaca recommended Firefox. Usually a good choice, but currently users should be cautious about which browser they choose: Opera just released version 10.51 of their web browser. According to the changelog, it fixes a vulnerability which could lead to execution of injected code. Users of opera 10.50 should update as soon as possible. ...

Microsoft is announcing an update to Windows XP Mode today that will make it a more accessible to PCs in small and midsize businesses who want to migrate to Windows 7 Professional but have applications that still require Windows XP. Windows XP Mode will no longer require hardware virtualization technology to run. This change makes it extremely easy for businesses to use Windows XP Mode to address any application incompatibility roadblocks they might have in migrating to Windows 7. Windows XP Mode will of course continue to use hardware virtualization technology such as Intel VT (Intel Virtualization Technology) or AMD-V if available. You can find more information and download the update which will go live later today here. ...

Exploit code for the the zero-day vulnerability in Internet Explorer has been added to the Metasploit framework. According to an email HD Moore wrote to ZDNet’s Ryan Naraine, the exploit works quite reliable – successful 50% of the times on Windows XP with SP2 and SP3 with IE7 and deactivated Data Execution Prevention (DEP). The security hole got reported yesterday on Microsoft’s March 2010 Patch Tuesday. Drive-by-Download-Exploits are likely to appear now as the Metasploit framework is open source and the exploit can now be abused even by script kiddies. Time to change the default browser – Microsoft just released a new browser choice screen which allows for exactly that!

Hello and welcome to this month’s blog on the Microsoft patch releases. This is a fairly quiet month—the vendor is releasing two bulletins covering a total of eight vulnerabilities. All of the issues are rated “Important” this month: seven affecting Office/Excel and one affecting Movie Maker and Producer. All of the issues are file-based remote code-execution vulnerabilities in the context of the currently logged-in user. Microsoft also released a security advisory (981374) today regarding a publicly disclosed vulnerability affecting Internet Explorer 6 and 7. Limited, targeted attacks exploiting this issue have been detected in the wild. ...

A Windows Update is available to users who are located in member countries of the European Union allowing for choosing a different standard browser for the system. The update is available for download through Windows Update. The Update creates a shortcut on your desktop. This shortcut leads to a Web page in which it is possible to select which Web browser to install. Additionally, the first time the users logs in to the computer after installing the update, Windows Internet Explorer starts automatically and displays the Browser Choice Web page. ...

After the Spring theme pack Microsoft has released a beautiful Life theme. It consists of five beautiful Discovery channel wallpapers based on wild life and nature. This is a official theme and can be applied just by double clicking on the theme file. Download: Life Theme pack for Windows 7

Microsoft has issued an advance notification for Patch Tuesday next week. The company said it expects to issue two patches, one for Windows and one for Office. Both are intended to patch vulnerabilities that could allow remote code execution and both are rated “important.” Microsoft Security Bulletin Advance Notification for March 2010 here.