Two Security Updates From Microsoft

Microsoft has released two extra security bulletins out of their normal monthly patch cycle:
MS09-034: Cumulative Security Update for Internet Explorer (972260)

MS09-035:Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)

Update MS09-034 is categorized as critical while MS09-035 update is categorized as moderate.

Updated security bulletin summary for July 2009 can be found here.

Unpatched Vulnerabilities In Adobe Reader, Acrobat And Flash Player

Adobe has published a security advisory regarding critical unpatched vulnerability in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat v9.x for Windows, Macintosh and UNIX operating systems.

Adobe expects to provide an update for Flash Player v9 and v10 for Windows, Macintosh, and Linux by July 30, 2009 (the date for Flash Player v9 and v10 for Solaris is still pending). They expect to provide an update for Adobe Reader and Acrobat v9.1.2 for Windows and Macintosh by July 31, 2009 (the date for Adobe Reader for UNIX is still pending).

While waiting for the update users may mitigate the threat by following the instructions given in the advisory.

Adobe will release updated information in its Adobe Product Security Incident Response Team blog.

Update For Firefox 3.0.x Available

Mozilla has released new update for older 3.0.x series of its web browser. Version 3.0.12 fixes six vulnerabilities of which five are categorized as critical and one as important.

Update can be obtained by using inbuilt updater of Firefox or by downloading it here.

Mozilla continues supporting Firefox 3.0.x series with security and stability updates until January 2010. All users are recommended to upgrade to Firefox 3.5 version.

Version 3.0.12 Release Notes

Malicious Spam Spread Under Swine Flu Theme

Swine flu is one of the biggest discussion topics in the world at the moment. Criminals are taking advantage of this too. F-Secure reports about malicious file spreading in emails. The file is named as Novel H1N1 Flu Situation Update.exe and icon is made to look like a Word document file. When opened, the file creates a few new files of which the executables contain backdoor functionality, including keylogger.

Firefox Version 3.5.1 Available

Mozilla has released update for its Firefox web browser. New version contains a fix to vulnerability in Just-in-time (JIT) JavaScript compiler. Affected is Firefox version 3.5.

Update can be obtained thru the browser's in-built updater or from Firefox download site.

Release notes for Firefox 3.5.1

Unpatched vulnerability In Firefox 3.5

There has been found an unpatched vulnerability in Firefox 3.5. The vulnerability exists in Just-in-time (JIT) JavaScript compiler and it can be used to execute malicious code. To exploit vulnerability an attacker has to trick user to open specially crafted web page containing the exploit code.

Mozilla offers two methods to workaround the problem until patch is available:
1) Temporary disabling the javascript.options.jit.content setting in about:config
2) Windows users can disable JIT by running Firefox in safe mode. This can be done by selecting Mozilla Firefox (Safe Mode) from the Mozilla Firefox folder.

The third method would be to disable Javascript by default by using NoScript add-on for Firefox.

More information:
http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/
http://isc.sans.org/diary.html?storyid=6796
http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761

Updates For July From Microsoft

Microsoft has released security updates for July. The release contains six packets. Three of those are categorized as critical:

- MS09-029: Vulnerabilities in the Embedded OpenType Font Engine Could Allow Remote Code Execution (961371)
- MS09-028: Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution (971633)
- MS09-032: Cumulative Security Update of ActiveX Kill Bits (973346)

and other three as important:

- MS09-033: Vulnerability in Virtual PC and Virtual Server Could Allow Elevation of Privilege (969856)
- MS09-031: Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege (970953)
-MS09-030: Vulnerability in Microsoft Office Publisher Could Allow Remote Code Execution (969516)

New version of Microsoft Windows Malicious Software Removal Tool was released too.

More information of the update and its contents can be read from here.

For consumer the easist way to get the update is to use Microsoft Update service.