Microsoft fixes drop in number for October, 2019 updates

Credit to Author: SophosLabs Offensive Security| Date: Wed, 09 Oct 2019 20:00:31 +0000

A relatively low number of vulnerabilities were addressed in this month’s Windows update rollups<img src=”http://feeds.feedburner.com/~r/sophos/dgdY/~4/kC7qjGbuUh8″ height=”1″ width=”1″ alt=””/>

Read more

Microsoft se apresura a arreglar un día cero de Internet Explorer

Credit to Author: Naked Security| Date: Thu, 26 Sep 2019 13:28:42 +0000

Los usuarios de Windows siempre tuvieron problemas de seguridad con Internet Explorer, y ahora que se ha reemplazado en Windows 10, es como si ahora estuvieran luchando para vivir de manera segura sin él. Por ejemplo, la prisa de esta semana por parte de Microsoft para corregir dos vulnerabilidades de alta prioridad que afectan a [&#8230;]<img src=”http://feeds.feedburner.com/~r/sophos/dgdY/~4/TwVohMC2jCk” height=”1″ width=”1″ alt=””/>

Read more

Microsoft releases even more patches for the CVE-2019-1367 IE zero-day, and the bugs are having a field day

Credit to Author: Woody Leonhard| Date: Fri, 04 Oct 2019 06:49:00 -0700

You may recall the Keystone Kops reenactment that goes by the code name CVE-2019-1367. In short:

Sept. 23: Microsoft released the CVE-2019-1367 bulletin, and published Win10 cumulative updates in the Microsoft Catalog for versions 1903, 1809, 1803, 1709, 1703, Server 2019 and Server 2016. It also released an IE rollup for Win7, 8.1, Server 2012 and Server 2012 R2. Those were only available by manual download from the Catalog — they didn’t go out through Windows Update, or through the Update Server. 

Sept. 24: Microsoft released “optional, non-security” cumulative updates for Win10 version 1809, 1803, 1709, 1703, 1607/Server 2016. Nothing for Win10 version 1903. We also got Monthly Rollup Previews for Win7 and 8.1. Microsoft didn’t bother to mention it, but we found that those Previews include the IE zero-day patch as well. This bunch of patches went out through normal channels — Windows Update, Update Server — but they’re “optional” and “Preview,” which means most savvy individuals and companies won’t install them until they’ve been tested.

To read this article in full, please click here

Read more

Time to install Microsoft's mainstream September patches – and avoid the dregs

Credit to Author: Woody Leonhard| Date: Wed, 02 Oct 2019 11:00:00 -0700

Read more

Post-retirement Windows 7 patches: Not just for the big dogs now

Credit to Author: Gregg Keizer| Date: Wed, 02 Oct 2019 05:29:00 -0700

Microsoft on Tuesday changed its plans for selling Windows 7 post-retirement support, saying that it will offer patches-for-a-price to any business, no matter how small, that’s willing to pay.

“Through January 2023, we will extend the availability of paid Windows 7 Extended Security Updates (ESU) to businesses of all sizes,” Jared Spataro, an executive in the Microsoft 365 group, wrote in a post to a company blog.

Microsoft had announced the ESU program in September 2018. Since April, when the company started selling ESU, only customers with volume licensing deals for Windows 7 Enterprise or Windows 10 Professional have been eligible to purchase the support add-on.

To read this article in full, please click here

Read more

Microsoft Patch Alert: Botched IE zero-day patch leaves cognoscenti fuming

Credit to Author: Woody Leonhard| Date: Mon, 30 Sep 2019 10:16:00 -0700

So you think Windows 10 patching is getting better? Not if this month’s Keystone Kops reenactment is an indicator.

In a fervent frenzy, well-meaning but ill-informed bloggers, international news outlets, even little TV stations, enjoyed a hearty round of “The Windows sky is falling!” right after the local weather. It wasn’t. It isn’t – no matter what you may have read or heard.

The fickle finger of zero-day fate

Microsoft has a special way of telling folks how important its patches might be. Every individual security hole, listed by its CVE number, has an “Exploitability Assessment” consisting of:

To read this article in full, please click here

Read more

What do we know about the big, scary, exploited, emergency-patched IE security hole CVE-2019-1367?

Credit to Author: Woody Leonhard| Date: Wed, 25 Sep 2019 07:29:00 -0700

Read more