Visit MVware @ Microsoft Management Summit (April 16th-20th) in Las Vegas

Keeping up to date with patches historically meant operating systems and applications from Microsoft.  In today’s threat landscape, however, third-party applications have become the leading cause of most vulnerabilities on the network.  Many companies around the world rely on Microsoft System Configuration Manager (SCCM) for patch management.  That simply is not enough to bolster network security, however, because Microsoft applications are not the only ones at risk.

Microsoft Management Summit 2012 begins today in Las Vegas and if you are attending the show, we invite you to stop by VMware booth #621.  We’ll be demonstrating the latest releases of our VMware vCenter Protect Update Catalog and VMware vCenter Protect Essentials at the booth.  These solutions simplify and automate patch management for Microsoft and third-party applications.

About VMware’s solutions for patch management

VMware vCenter Protect Update Catalog extends SCCM beyond Microsoft products to solve critical third-party patch management needs.  vCenter Protect Update Catalog plugs into SCCM as a simple data service that requires no additional agents, console or management to learn.  Just import the third-party patch catalog for Adobe, Google, Java Firefox, iTunes, etc. into SCCM and you’ll be patching vulnerabilities on your servers and workstations in minutes.  Click here to learn more about vCenter Protect Update Catalog.

VMware vCenter Protect Essentials reduces the cost and complexity of IT management with an integrated approach to IT security and compliance.  vCenter Protect Essentials provides centralized Windows patch management and asset inventory management for both virtual and physical machines.  This includes centralized management for Windows operating systems and the most widely used Windows-hosted applications running on both virtual and physical servers and workstations.  Click here to learn more about vCenter Protect Essentials.

Hope to see you in Las Vegas this week, and don’t forget to enter your name to win an Xbox 360 with Kinect at booth #621.

– Mike Bleakmore

April 2012 Patch Tuesday Overview

Microsoft has released six bulletins addressing 11 vulnerabilities in the April 2012 version of Patch Tuesday.

Marking the fourth Patch Tuesday of the year, Microsoft and non-Microsoft vendors are making this quite an interesting month with critical security bulletins and new products to consider in your monthly Patch Tuesday.

There are many products that are affected by the new security bulletins. This means you will be seeing quite a few patches missing on a single machine.  For example, MS12-027 affects 29 different products and service pack levels.  For those administrators responsible for reporting their patch compliance, this can be quite a headache.

As scheduled, Microsoft has released their bi-monthly update for Internet Explorer.  With any browser (Microsoft or non-Microsoft), patching is always on the top of the priority list as Internet browsers are one of the most targeted pieces of software for exploitation.  With Internet Explorer 10 (bundled with Windows 8), Microsoft is turning on automatic updates in the background.  We will have to wait and see if Microsoft increases their patch releases for their browser like Google Chrome and Mozilla Firefox.  Since the last time Microsoft has patched Internet Explorer (February 2012 Patch Tuesday), Google released new updates to their browser seven times.  Five of these releases were security releases. 

Speaking of browsing threats, MS12-027 is a bulletin that can be attacked via browsing.  MS12-027 fixes one vulnerability that Microsoft has received limited attacks against.  Browsing to a malicious website with Internet Explorer will result in remote code execution.  An attacker could also try sending a RTF file with embedded malicious ActiveX controls.  If the user opens the file on an unpatched system, the attacker can gain full access to the system.  As Microsoft has already seen active exploits against this vulnerability and it contains a web browsing scenario, it will be critical to push this patch out to your desktop systems as soon as possible. 

On a different front for this security bulletin, software developers will need to pay particular attention to the information inside of this bulletin.  Any developer that has released an ActiveX control should review the information for this security bulletin.  These developers may need to release updates to their own software to ensure they are not using a vulnerable file in their ActiveX control.

With this Patch Tuesday we are also seeing the first security bulletin affecting the Windows 8 Consumer Preview.  Anyone using this operating system will want to apply MS12-024.  It is good to see that Microsoft is not forgetting about their widely available (and used) preview operating system.

There are a few non-Microsoft vendors joining the Patch Tuesday security bulletin party with their own releases.  Adobe is releasing updates for their Acrobat and Reader product lines during their own quarterly security bulletin update (APSB12-08).  This security update addresses four vulnerabilities.

Google has released an update for their Chrome browser with version 18.0.1025.152.  This latest version of the Google Chrome browser is a non-security update.

I will be talking about the April Patch Tuesday as well as any other non-Microsoft patches that have been recently released tomorrow, April 11th at 11:00am CT in part of our monthly Patch Tuesday webinar.  Click here to register for the webinar.

– Jason Miller

April 2012 Patch Tuesday Advanced Notification

Microsoft has released their Advance Notification for the upcoming April Patch Tuesday.  With the six bulletins announced, Microsoft is planning to address 11 vulnerabilities.  This marks Microsoft’s heavy patch month and we are seeing this with the sheer number of affected products this month.  We are also looking at a heavy server patching month to go along with all workstations being affected.

 Security Bulletin Breakdown:

  • 4 bulletins are rated as Critical
  • 2 bulletins are rated as Important
  • 5 bulletins addressing vulnerabilities that could lead to Remote Code Execution
  • 1 bulletin addressing a vulnerability that could lead to Elevation of Privilege

 Affected Products:

  • All supported Microsoft operating systems
  • All supported Internet Explorer browsers
  • Microsoft Office 2003, 2007, 2010
  • Microsoft Office 2003 Web Components
  • Microsoft SQL Server 2000, 2005, 2008, 2008 R2
  • Microsoft BizTalk Server 2002
  • Microsoft Commerce Server 2002, 2008, 2009, 2009 R2
  • Microsoft Visual FoxPro 8, 9
  • Microsoft Visual Basic 6.0 Runtime
  • Microsoft Forefront Unified Access Gateway

 I will be going over the April Patch Tuesday in detail in addition to any other non-Microsoft releases since the last Patch Tuesday in our Monthly Patch Tuesday webinar.  This webinar is scheduled for next Wednesday, April 11th at 11:00am CST.  You can register for this webinar here.

 – Jason Miller