Superstitious? Microsoft Tempts Fate – Thirteen On The Thirteenth

By Marc Handelman on October 12th, 2009

Win7 Scenes

Redmond, Washington based Microsoft Corporation (NasdaqGS: MSFT) has issued the company’s familiar Patch Tuesday notification, slated for deployment via Windows Update on October 13, 2009. This package set comprises thirteen updates for a wide range of issues, including patches for Windows 7 RTM. A snippet of the advisory appears after the jump, as well as other news stories related to this post.

From HeiseSecurity: “13 security updates on the forthcoming Microsoft Patch Tuesday”

Microsoft has announced 13 bulletins for the forthcoming Patch Tuesday on the 13th of October. Eight of the bulletins describe critical holes in Windows, Office, Silverlight, Forefront, SQL Server and Microsoft’s Developer Tools. Five of the holes affect Windows 7, which means that the first security updates will have been released before Windows 7 officially goes on sale, although the operating system has been available to download via MSDN for several weeks and is already in production use with a number of customers….”

Microsoft Security Bulletin Advance Notification for October 2009

Microsoft Security Bulletin Advance Notification issued: October 8, 2009
Microsoft Security Bulletins to be issued: October 13, 2009

This is an advance notification of security bulletins that Microsoft is intending to release on October 13, 2009.

This bulletin advance notification will be replaced with the October bulletin summary on October 13, 2009. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.

Microsoft will host a webcast to address customer questions on these bulletins on October 14, 2009, at 11:00 AM Pacific Time (US & Canada). Register now for the October security bulletin webcast. After this date, this webcast is available on-demand. For more information, see Microsoft Security Bulletin Summaries and Webcasts.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

Bulletin Information

Executive Summaries

This advance notification provides a number as the bulletin identifier, because the official Microsoft Security Bulletin numbers are not issued until release.

The bulletin summary that replaces this advance notification will have the proper Microsoft Security Bulletin numbers (in the MSyy-xxx format) as the bulletin identifier.

The following table summarizes the security bulletins for this month in order of severity.

For details on affected software, see the next section, Affected Software.

Bulletin ID	Maximum Severity Rating and Vulnerability Impact	Restart Requirement	Affected Software
Bulletin 1	Critical Remote Code Execution	Requires restart	Microsoft Windows
Bulletin 2	Critical Remote Code Execution	May require restart	Microsoft Windows
Bulletin 3	Critical Remote Code Execution	May require restart	Microsoft Windows
Bulletin 5	Critical Remote Code Execution	Requires restart	Microsoft Windows, Internet Explorer
Bulletin 6	Critical Remote Code Execution	May require restart	Microsoft Windows
Bulletin 11	Critical Remote Code Execution	May require restart	Microsoft Office
Bulletin 12	Critical Remote Code Execution	May require restart	Microsoft Windows, Microsoft Silverlight
Bulletin 13	Critical Remote Code Execution	May require restart	Microsoft Windows, Microsoft Office, Microsoft SQL Server, Microsoft Developer Tools, Microsoft Forefront
Bulletin 4	Important Remote Code Execution	May require restart	Microsoft Windows
Bulletin 7	Important Spoofing	Requires restart	Microsoft Windows
Bulletin 8	Important Remote Code Execution	Requires restart	Microsoft Windows
Bulletin 9	Important Elevation of Privilege	Requires restart	Microsoft Windows
Bulletin 10	Important Denial of Service	Requires restart	Microsoft Windows

—
from Microsoft
reply-to Microsoft <10_198467_Evesxvt7oxGyXhPbe8jvow@newsletters.microsoft.com>
to mhandelman@infosecurity.us
date Thu, Oct 8, 2009 at 13:46
subject Security Bulletin Advance Notification for October 2009
mailed-by newsletters.microsoft.com

hide details Oct 8 (3 days ago)

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

********************************************************************
Microsoft Security Bulletin Advance Notification for October 2009
Issued: October 8, 2009
********************************************************************

This is an advance notification of security bulletins that
Microsoft is intending to release on October 13, 2009.

The full version of the Microsoft Security Bulletin Advance
Notification for October 2009 can be found at

http://www.microsoft.com/technet/security/bulletin/ms09-oct.mspx.

This bulletin advance notification will be replaced with the
October bulletin summary on October 13, 2009. For more
information about the bulletin advance notification service, see

http://www.microsoft.com/technet/security/Bulletin/advance.mspx.

To receive automatic notifications whenever Microsoft Security
Bulletins are issued, subscribe to Microsoft Technical Security
Notifications on

http://www.microsoft.com/technet/security/bulletin/notify.mspx.

Microsoft will host a webcast to address customer questions on
these bulletins on October 14, 2009,
at 11:00 AM Pacific Time (US & Canada). Register for the
Security Bulletin Webcast at

http://www.microsoft.com/technet/security/bulletin/summary.mspx.

Microsoft also provides information to help customers prioritize
monthly security updates with any non-security, high-priority
updates that are being released on the same day as the monthly
security updates. Please see the section, Other Information.

This advance notification provides a number as the
bulletin identifier, because the official Microsoft Security
Bulletin numbers are not issued until release. The bulletin summary
that replaces this advance notification will have the proper
Microsoft Security Bulletin numbers (in the MSyy-xxx format) as the
bulletin identifier. The security bulletins for this month are as
follows, in order of severity:

Critical Security Bulletins
===========================

Bulletin 1

- Affected Software:
- Windows Vista,
Windows Vista Service Pack 1, and
Windows Vista Service Pack 2
- Windows Vista x64 Edition,
Windows Vista x64 Edition Service Pack 1, and
Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and
Windows Server 2008 for 32-bit Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for x64-based Systems and
Windows Server 2008 for x64-based Systems Service Pack 2
(Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for Itanium-based Systems and
Windows Server 2008 for Itanium-based Systems Service Pack 2