Microsoft January 2008 Security Bulletins

As part of Microsoft's routine, monthly security update cycle, today they released two new security bulletins that affects Windows system.
Note: There may be latency issues due to replication, if the page does not display keep refreshing.

Critical

• MS08-001 - Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution (941644)

Important

• MS08-002 - Vulnerability in LSASS Could Allow Local Elevation of Privilege (943485)

Microsoft also released Non-Security, High-Priority Updates on MU, WU, and WSUS:
- Five non-security, high-priority updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).
- Two non-security, high-priority updates for Windows on Windows Update (WU) and WSUS.

Microsoft Windows Malicious Software Removal Tool
Microsoft has released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

References:
January 2008 Security Bulletin Summary: http://www.microsoft.com/technet/security/bulletin/ms08-jan.mspx
Security Bulletin for end-users: http://www.microsoft.com/protect/computer/updates/bulletins/200801.mspx
MSRC Blog: http://blogs.technet.com/msrc/archive/2008/01/08/january-2008-monthly-release.aspx

Support:
Call 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. International users should go to http://support.microsoft.com/common/international.aspx

Security Bulletin Webcast:
Microsoft will host a Webcast tomorrow. The webcast focuses on addressing your questions and concerns about the security bulletins. Therefore, most of the live webcast is aimed at giving you the opportunity to ask questions and get answers from their security experts.

Update sources:
Microsoft NEVER send security updates via e-mail. As always, download the updates only from the vendors' website - visit Windows Update and Office Update or Microsoft Update. You may also get the updates thru Automatic Updates functionality in Windows.
Security updates are available on ISO-9660 DVD5 image files from the Microsoft Download Center. For more information, please see http://support.microsoft.com/kb/913086
Note: Don't be a victim of spoofed emails. Read "How to tell whether a security e-mail message is really from Microsoft"

Recommendations:
Microsoft advises customers to install the latest product releases, security updates, and service packs to remain as secure as possible. Older products, such as Microsoft Windows NT 4.0, may not meet today's more demanding security requirements. It may not be possible for Microsoft to provide security updates for older products. More info at Microsoft Support Lifecycle website.

Report Security Vulnerability to Microsoft:
If you have found a Microsoft security vulnerability, please report: https://www.microsoft.com/technet/security/...in/alertus.aspx

Tool:
Check your system for missing or misconfigured patches using Microsoft Baseline Security Analyzer (MBSA).
For 3rd Party tools in scanning your computer for missing updates, hotfixes, end of life or out-dated version, please see the list at http://www.dozleng.com/updates/index.php?showtopic=13587

Cumulative Update for Media Center for Windows Vista (KB941229)

This update addresses issues with Media Center for Microsoft Vista. For complete listing of issues included in this cumulative update, see KB941229. After you install this item, you may have to restart your computer.
This update is provided to you and licensed under the Windows Vista License Terms.

32 Bit- http://www.microsoft.com/downloads/details...;DisplayLang=en

64 Bit- http://www.microsoft.com/downloads/details...;DisplayLang=en

Official Updates for improving Vista Compatibility Performance reliability

SInce last week there were lots of buzz about these packs as they were released internally and were available unofficially over the net and later many sites had to remove the links as they wer illegal to distribute.

Now they have been released officially. Get them here:

An update is available that improves the compatibility and reliability of Windows Vista : (938194)

This update resolves the following issues:•    The screen may go blank when you try to upgrade the video driver. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
932539 The screen may go blank when you try to upgrade the video driver on a Windows Vista-based computer
•    The computer stops responding, and you receive a "Display driver stopped responding and has recovered" error message. You can restart the computer only by pressing the computer's power button.
•    The computer stops responding or restarts unexpectedly when you play video games or perform desktop operations.
•    The Diagnostic Policy Service (DPS) stops responding when the computer is under heavy load or when very little memory is available. This problem prevents diagnostics from working.
•    The screen goes blank after an external display device that is connected to the computer is turned off. For example, this problem may occur when a projector is turned off during a presentation.
•    A computer that has NVIDIA G80 series graphic drivers installed stops responding.
•    Visual appearance issues occur when you play graphics-intensive games.
•    You experience poor playback quality when you play HD DVD disks or Blu-ray disks on a large monitor.
•    Applications that load the Netcfgx.dll component exit unexpectedly.
•    Windows Calendar exits unexpectedly after you create a new appointment, create a new task, and then restart the computer.
•    Internet Connection Sharing stops responding after you upgrade a computer that is running Microsoft Windows XP to Windows Vista and then restart the computer.
•    The Printer Spooler service stops unexpectedly.
•    You receive a "Stop 0x0000009F" error when you put the computer to sleep while a Point-to-Point Protocol (PPP) connection is active. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
931671 Error message when you put a Windows Vista-based computer to sleep while a PPP connection is active: "STOP 0x0000009F"

Update for Windows Vista x86-based versions

Update for Windows Vista 64-bit versions

An update is available that improves the performance and reliability of Windows Vista : 938979

This update resolves issues that may affect some Windows Vista-based computers. These issues have been reported by customers who are using the Error Reporting service or Microsoft Customer Support Services.
By applying this update, you can achieve better performance and responsiveness in various scenarios. This update also improves the reliability of Windows Vista.
This update resolves the following issues on a Windows Vista-based computer:•    You experience a long delay when you try to exit the Photos screen saver.
•    A memory leak occurs when you use the Windows Energy screen saver.
•    If User Account Control is disabled on the computer, you cannot install a network printer successfully. This problem occurs if the network printer is hosted by a Windows XP-based or a Windows Server 2003-based computer.
•    When you write data to an AVI file by using the AVIStreamWrite function, the file header of the AVI file is corrupted.
•    When you copy or move a large file, the "estimated time remaining" takes a long time to be calculated and displayed.
•    After you resume the computer from hibernation, it takes a long time to display the logon screen.
•    When you synchronize an offline file to a server, the offline file is corrupted.
•    If you edit an image file that uses the RAW image format, data loss occurs in the image file. This problem occurs if the RAW image is from any of the following digital SLR camera models:    •    Canon EOS 1D
•    Canon EOS 1DS
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
932988 Files from a Canon EOD 1D or 1DS camera may be corrupted after you use Windows Photo Gallery, Windows Live Photo Gallery, or Windows Explorer to edit the file metadata in Windows Vista or in Windows XP Service Pack 2
•    After you resume the computer from hibernation, the computer loses its default gateway address.
•    Poor memory management performance occurs.

Update for Windows Vista, 32-bit versions

Update for Windows Vista, 64-bit versions

Updates for Outlook 2003/2007 Junk Email Filter (March 2007)

Update for Outlook 2003 Junk Email Filter (KB931764)
This update provides the Junk E-mail Filter in Microsoft Office Outlook 2003 with a more current definition of which e-mail messages should be considered junk e-mail. This update was released in March 2007.
Supported Operating Systems: Windows Server 2003; Windows XP

Update for Outlook 2007 Junk Email Filter (KB931766)
This update provides the Junk E-mail Filter in Microsoft Office Outlook 2007 with a more current definition of which e-mail messages should be considered junk e-mail. This update was released in March 2007.
Supported Operating Systems: Windows Server 2003; Windows XP

Download: Microsoft Outlook 2003 (KB931764) (3.3 MB | WGA)
Download: Microsoft Outlook 2007 (KB931766) (4.3 MB | WGA)

Microsoft Security Bulletin Summary for January 2007

Title: Microsoft Security Bulletin Summary for January 2007
Issued: January 09, 2007
Version Number: 1.0
Bulletin: http://go.microsoft.com/fwlink/?LinkId=80465

Critical Security Bulletins
===========================

MS07-002 - Vulnerabilities in Microsoft Excel Could Allow Remote
Code Execution (927198)

- Affected Software:
- Excel 2000
- Excel 2002
- Excel 2003
- Excel Viewer 2003
- Microsoft Works Suites 2004 and 2005
- Microsoft Office 2004 for Mac
- Microsoft Office v.X for Mac

- Impact: Remote Code Execution
- Version Number: 1.0

MS07-003 - Vulnerabilities in Microsoft Outlook Could Allow Remote
Code Execution (925938)

- Affected Software:
- Outlook 2000
- Outlook 2002
- Outlook 2003

- Impact: Remote Code Execution
- Version Number: 1.0

MS07-004 - Vulnerability in Vector Markup Language Could Allow
Remote Code Execution (929969)

- Affected Software:
- Windows 2000 Service Pack 4
- Windows XP Service Pack 2
- Windows XP Professional x64 Edition
- Windows Server 2003
- Windows Server 2003 Service Pack 1
- Windows Server 2003 for Itanium-based Systems
- Windows Server 2003 with SP1 for Itanium-based Systems
- Windows Server 2003 x64 Edition
- Internet Explorer 5.01 Service Pack 4 on Windows 2000 Service
Pack 4
- Internet Explorer 6 Service Pack 1 on Windows 2000 Service
Pack 4
- Internet Explorer 7 on Windows XP Service Pack 2
- Internet Explorer 7 on Windows Server 2003 and Windows Server
2003 Service Pack 1
- Internet Explorer 7 on Windows XP Professional x64 Edition
- Internet Explorer 7 on Windows Server 2003 for Itanium-based
Systems
- Internet Explorer 7 on Windows Server 2003 x64 Edition

- Impact: Remote Code Execution
- Version Number: 1.0

Important Security Bulletins
============================

MS07-001 - Vulnerability in Microsoft Office 2003 Brazilian
Portuguese Grammar Checker That Could Allow Remote Code
Execution (921585)

- Affected Software:
- Office 2003 Service Pack 2 (Brazilian Portuguese Version)
- Microsoft Office Multilingual User Interface 2003 Service Pack
2
- Microsoft Project Multilingual User Interface 2003 Service Pack
2
- Microsoft Visio Multilingual User Interface 2003 Service Pack 2
- Microsoft Office Proofing Tools 2003 Service Pack 2

- Impact: Remote Code Execution
- Version Number: 1.0

Microsoft to release 8 security patches for january

Although the information is subject to change until the day of, on 9 January 2007 Microsoft will Release 8 Security Patches:

• Three Microsoft Security Bulletins affecting Microsoft Windows with the highest Maximum Severity rating being Critical. (detectable using Microsoft Baseline Security Analyzer & Enterprise Scan Tool)
• One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft Visual Studio with the highest Maximum Severity rating being Important. (detectable using Microsoft Baseline Security Analyzer & Enterprise Scan Tool)
• One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft Office with the highest Maximum Severity rating being Important. (detectable using Microsoft Baseline Security Analyzer)
• Three Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. (detectable using Microsoft Baseline Security Analyzer)

(All updates may require a restart)
Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center but not on Software Update Services (SUS). As well, Microsoft will release two NON-SECURITY High-Priority Updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).
Microsoft will host a webcast on Wednesday, January 10, 11:00 AM Pacific Time (US & Canada) to address customer questions on these bulletins.
News source: Bink