If you were hoping for a nice relaxing Patch Tuesday after the holidays, well, sorry to disappoint you. Microsoft will be issuing seven new bulletins next week, two of them are rated as 'Critical'. Both critical bulletins can result in the holy grail of remote code execution. The other five bulletins are all rated as 'Important'.
Of the two critical bulletins one of them lists all currently supported versions of Windows from XP SP3 up to Server 2008 R2 as well as several versions of Office, SharePoint and Groove Server. This is most likely an issue in one of the base libraries meaning it will have a wide impact. The other critical bulletin only lists Windows 7 and Server 2008 as vulnerable but it still results in RCE so it shouldn't be taken as any less serious.
The five remaining 'Important' bulletins result mostly in Elevation of Privilege with one Security Feature Bypass and one Denial of Service. Six of them impact different versions of Windows and Windows Server with one Elevation of Privilege hitting Microsoft System Center Operations Manager. The MS SCOM is a cloud management platform allowing you to manage multiple hypervisors.
In addition to these you have probably heard of the zero-day vulnerability that exists in Internet Explorer 6, 7 and 8 that is actively being used in targeted attacks. While the update for the zero-day won't be included in this month's bunch of updates, Microsoft has already released a Fix-It tool for it.
But that's not all, there are also active ongoing attacks using fraudulent certificates issued by TURKTRUST inc. The fraudulent certs were issued for*.google.com and could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Google web properties. Microsoft has already updated the Certificate Trust List. If you are using the automatic updater of revoked certificates you are all set. If not, or you are still using XP or Server 2003, you will find an update for you in Microsoft Update.
We will have full details of all seven bulletins next Tuesday when Microsoft releases the full details.
