Hi everyone, Stephen Toulouse here again.  Just wanted to make you aware that we have reached the point in our investigation of the limited attacks trying to use the Word vulnerability that provided us with enough information to develop some stronger workarounds and mitigations.  We've posted all that into a new security advisory:

http://www.microsoft.com/technet/security/advisory/919637.mspx

Hi everyone, Stephen Toulouse here again.  I wanted to catch you up on where we’re at with our investigation of the Word vulnerability. 

First off on the vulnerability itself: I want to reiterate we’re hard at work on an update.  The attack vector here is Word documents attached to an email or otherwise delivered to a user’s computer.  The user would have to open it first for anything to happen.  That information isn’t meant to say the issue isn’t serious, it’s just meant to clearly denote the scope of the threat.

Now, we’ve received singular reports of attacks and have been working directly with the couple of customers thus far affected.  In analyzing the malware we’ve added detection to the Windows Live Safety Center, and we’ve passed all that information over to our antivirus partners.  But in breaking down the current malware we discovered some commonality to the current attack.  The attack we’ve seen is email based.  The emails tend to arrive in groups, they often have fake domains that are similar to real domains of the targets, but the targets are valid email addresses. 

Currently two of the subject lines we have seen are: 

Notice

RE Plan for final agreement

The attack we have seen so far requires admin rights, so limitations on user accounts can help here.  I want to repeat that customers who believe they are affected can contact Product Support Services.  You can contact Product Support Services in North America for help with security update issues or viruses at no charge using the PC Safety line (1866-PCSAFETY) and international customers by using any method found at this location:

http://support.microsoft.com/security.

So far, this is a *very* limited attack, and most of our antivirus partners are rating this as “low”.  But we’re working to investigate any variants we might see to make sure detection is out there, as well as working on the update to address the vulnerability.

S. 

PS: Michael Howard recently wrote a great article for not running as admin.  It can be found here:  http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure01182005.asp

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hi everyone, Stephen Toulouse here.  We've been made aware of a new vulnerability in Microsoft Word XP and Word 2003.  Customers using the Word viewer to view documents are not impacted.  Yesterday we recieved a report that a customer had been subjected to a very targeted attack using this vulnerability. 

Here's what we know: In order for this attack to be carried out, a user must first open a malicious Word document attached to an e-mail or otherwise provided to them by an attacker.  (note that opening it out of email will prompt you to be careful about opening the attachment) So remember to be very careful opening unsolicited attachments from both known and unknown sources.

So what are we doing?

Our anti-malware teams are adding detection to the Windows Live Safety Center today for up-to-date removal of malicious software that attempts to exploit the vulnerability.  The Windows Live Safety Center is located at the following website: 

http://safety.live.com
 
We’re also actively sharing that information with our Virus Information Alliance partners so that their detection can be up to date to detect and remove attacks. The Office team is hard at work on an update that addresses the vulnerability.  It's in testing right now to make sure it's of the right quality for release.  Right now we're on schedule to be released as part of the June security updates on June 13, 2006, or sooner as warranted.
 
As always, customers who believe they are affected can contact Product Support Services.  You can contact Product Support Services in North America for help with security update issues or viruses at no charge using the PC Safety line (1866-PCSAFETY) and international customers by using any method found at this location: http://support.microsoft.com/security.

S.

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Hello,

This is Christopher Budd.  I wanted to take a moment and let folks know that this month's IT Pro Security newsletter has an article that I hope will be helpful for those of you who manage security updates.

It's called Ten Principles of Microsoft Patch Management and in it I try o outline not so much the "how" of patch management but rather more of the "why" behind what we do.

Over the years, I've found many questions that customers have around bulletins and security updates are best answered by trying to help people understand the way we approach the process. In this article, I've tried to outline the ten most important points that I think will help you to better understand how we approach patch management so you can integrate better with our processes.

You can see the current newsletter here:
http://www.microsoft.com/technet/security/secnews/newsletter.htm

On that page, you can sign up to have each month's newsletter e-mailed directly to you.
 
Also, here's a link directly to the article:
http://www.microsoft.com/technet/community/columns/secmgmt/sm0506.mspx

I hope you find this article helpful.

Christopher

*This posting is provided "AS IS" with no warranties, and confers no rights.*

This is Craig Gehre and there are two things I wanted to let you know about.  Some of you may have been getting install errors on the Flash update, MS06-020, we released on Tuesday.  You would have seen these install failure errors on Windows Update, Microsoft Update, or on your system via Automatic Update.  There is nothing wrong with the update itself.  What was happening is that we were offering the update to newer versions of Flash, which did not need the update, in addition to the systems that did need it.  We’ve now fixed the detection error so that the update's only offered to systems that do need it.  If you already applied the update or previously got the error, you do not need to take any action.

The second thing is that WSUS and SMS admins are going to notice that there is a new wsusscan.cab available.  This is to include the above mentioned Flash fix and also to fix some description text errors we had with part of the Exchange release, MS06-019.

Thanks,

Craig

*This posting is provided "AS IS" with no warranties, and confers no rights.*

Say heh?

I have to be honest.  I’ve been in the MSRC now for a while, seen a lot of “interesting” things happen around here and it is a bit of a trip to look at our list of bulletins we shipped today and see the words Flash, Adobe, and Macromedia in the titles.  Different to say the least.  Anyways, below are links to the bulletins we release today.  Fairly light release and the detection/deployment story is fairly smooth.  Microsoft Update and WSUS will offer you everything we released this month.  Yes, even the Flash fix…

MS06-018 applies to Microsoft Windows and is rated moderate.

MS06-019 applies to Microsoft Exchange and is rated critical.

MS06-020 applies to Microsoft Windows and is rated critical.

The bulletins went live this morning at approximately 10:25 a.m. Pacific Time but if you're looking for more information you can find it at: http://www.microsoft.com/security/. 

Don't forget to tune into the monthly technical webcast tomorrow at 11am Pacific Time and, as an added resource this month, you can tune into TechNet Radio to hear the new monthly interview with our very own Christopher Budd discussing this months' updates as well: http://www.microsoft.com/tnradio.

This is Christopher Budd. I wanted to take a moment and let you know that we've posted our regular Monthly Advanced Notification for the upcoming bulletin release.

http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032294228&EventCategory=4&culture=en-US&CountryCode=US