Microsoft Patch Tuesday for Sep 2016

Patch Tuesday link



- wong chee tat :)

Microsoft Security Bulletins

Microsoft Security Bulletins

Link


- wong chee tat :)

Patch Tuesday - July 2016

Webpages, Word files, print servers menacing Windows PCs, and disk encryption bypasses – yup, it's Patch Tuesday

Plus: 52 security bugs fixed in Adobe Flash

19

36

12 Jul 2016 at 20:53, Shaun Nichols

Microsoft will fix critical holes in Internet Explorer, Edge, Office and Windows with this month's Patch Tuesday security bundle. Meanwhile, Adobe has patched dozens of exploitable vulnerabilities in its Flash player.
Redmond's July release includes 11 sets of patches, six rated as "critical" and five classified as "important." The highlights are: a BitLocker device encryption bypass, evil print servers executing code on vulnerable machines, booby-trapped webpages and Office files injecting malware into PCs, and the usual clutch of privilege elevation flaws.
Get patching now before miscreants develop and distribute code exploiting the programming blunders. As far as we can tell, none of the bugs below are being exploited in the wild right now.

• MS16-084 is a cumulative fix for Internet Explorer that addresses 15 CVE-listed vulnerabilities, including five memory corruption bugs and four scripting engine memory corruption bugs that can be exploited to execute code remotely on vulnerable machines. In other words, opening up a booby-trapped website that exploits these flaws could lead to malware infecting your PC.
  "The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user," said Microsoft.
• MS16-085 is also a cumulative browser fix, this time for the new Edge browser. Among the 13 CVE-listed holes in Edge are five remote code execution flaws in the Chakra JavaScript engine. Also patched are three information disclosure flaws, three spoofing vulnerabilities, and two other memory corruption flaws. Again, a malicious webpage could use these security holes to infect PCs with software nasties.
• MS16-088 patches seven memory corruption vulnerabilities in Office. The flaws could allow remote code execution if opened as local documents or information disclosure if targeted at SharePoint or Office Web Apps server. Office for Mac users will receive an update as well. Basically, malicious software can be smuggled in Office documents and will infect computers when opened.
• MS16-094 remedies a security bypass flaw in Windows Secure Boot. An attacker with admin or physical access – such as a thief or someone who has seized your PC – can exploit the vulnerability to install a policy that bypasses BitLocker and disk encryption.
  "A security feature bypass vulnerability exists when Windows Secure Boot improperly applies an affected policy," Microsoft explained.
  "An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, an attacker could bypass the Secure Boot Integrity Validation for BitLocker and the Device Encryption security features.
  "To exploit the vulnerability, an attacker must either gain administrative privileges or physical access to a target device to install an affected policy. The security update addresses the vulnerability by blacklisting affected policies."
• MS16-093 is Microsoft's distribution of this month's Adobe Flash Player security fixes. In all, 24 CVE-listed flaws are addressed, including remote code execution vulnerabilities. Users running Windows 8.1 and later and Server 2012 will get this update automatically. Older versions will need to get the update from Adobe (more details below).
• MS16-086 covers a single remote code execution flaw in the JScript and VBScript engines for Windows Vista and Server 2008. Later versions are not affected. "The vulnerability could allow remote code execution if a user visits a specially crafted website," admitted Microsoft.
• MS16-090 addresses six elevation of privilege vulnerabilities in all supported versions of Windows and Windows Server. An attacker can run a specially crafted application that exploits the kernel-level flaws to increase their user permissions and take over the system.
• MS16-087 is an update for flaws in the print spooler component of Windows: a man-in-the-middle attacker on a network can execute code on a remote vulnerable machine, or elevate their privileges if already running code on a system. Essentially, a rogue printer server on a network can inject malware into connected PCs. All supported versions of Windows and Windows Server are vulnerable.
• "A remote code execution vulnerability exists when the Windows Print Spooler service does not properly validate print drivers while installing a printer from servers," Microsoft confessed. "An attacker who successfully exploited this vulnerability could use it to execute arbitrary code and take control of an affected system.
• "An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application."
• MS16-089 fixes a single information disclosure flaw triggered when the Windows 10 kernel improperly handles objects in memory.
• MS16-091 is a patch for an information disclosure flaw in the .NET Framework triggered by running an XML file on a web application. The bug is found in all supported versions of Windows and Windows Server.
• MS16-092 addresses two flaws in the Windows kernel, one that discloses information about the kernel and another bypassing security access checks. All supported versions of Windows and Windows Server should be updated.

Meanwhile, Adobe is applying a few more strips of duct tape to holes in the internet's screen door with the July Flash Player update.
Windows, OS X, Linux, and ChromeOS users should check to make sure they have the latest version of the software.
In total, this month's patch remedies 52 CVE-listed vulnerabilities. If targeted, 49 of those would allow remote code execution, while the other three would allow information disclosure and memory leaks.
Adobe has also released an update for Acrobat/Reader and XMP Toolkit for Java. ®

- wong chee tat :)

Microsoft Security Advisory 2962393

Microsoft Security Advisory 2962393

Update for Vulnerability in Juniper Networks Windows In-Box Junos Pulse Client
Published: May 5, 2014 | Updated: June 9, 2015
Version: 2.0

Microsoft is announcing the availability of an update for the Juniper Networks Windows In-Box Junos Pulse Client for Windows 8.1 and Windows RT 8.1. The update addresses a vulnerability in the Juniper VPN client by updating the affected Juniper VPN client libraries contained in affected versions of Microsoft Windows.

Juniper VPN Client Update

Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

On June 9, 2015, Microsoft released an update (3062760) for the Juniper Networks Windows In-Box Junos Pulse VPN client. The update addresses the vulnerability described in Juniper Security Advisory JSA29833. Customers who are not using a Juniper VPN solution are not vulnerable; however, Microsoft recommends applying the update on an all affected operating systems since the affected component is present in-box. For more information about this update, including download links, see Microsoft Knowledge Base Article 3062760.

Note Updates for Windows RT 8.1, Windows Technical Preview, and Windows Server Technical Preview are available via Windows Update.

Affected Software

This advisory discusses the following software.
Operating System
Component
Windows 8.1 for 32-bit Systems
Juniper Networks Windows In-Box Junos Pulse Client
Windows 8.1 for x64-based Systems
Juniper Networks Windows In-Box Junos Pulse Client
Windows RT 8.1
Juniper Networks Windows In-Box Junos Pulse Client

Non-Affected Software
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows Server 2012
Windows RT
Windows Server 2012 R2
Server Core installation option
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)

Frequently Asked Questions

What is the scope of the advisory?
The purpose of this advisory is to announce the availability of an update for Juniper Networks Windows In-Box Junos Pulse VPN client for Windows 8.1 and Windows RT 8.1.

What is Juniper Networks Windows In-Box Junos Pulse Client?
Juniper Networks Windows In-Box Junos Pulse Client is a third-party VPN product that is shipped in-box as part of the Windows operating system. Windows In-Box Pulse Client appears as a VPN Provider network option within Windows 8.1 and later endpoints, including Windows RT 8.1 endpoints. It allows the user to establish a Layer 3 VPN connection to Junos Pulse Secure Access Service and to create, manage, and remove Pulse VPN connections on the Windows endpoint through Windows PowerShell scripts. The user can also create connections manually on the endpoint. Windows In-Box Junos Pulse Client provides a subset of the features that are available through the Junos Pulse for Windows client.

What is VPN?
Virtual private networks (VPNs) are point-to-point connections over a private or public intermediate network, such as the Internet, allowing users to remotely access private networks that otherwise would not be accessible from the Internet, or administrators to connect remote sites together.  For more information about VPN technologies as well as how to configure them on Windows, please see What Is VPN?.

What does the update do?
The update addresses the vulnerability by updating the Juniper Networks VPN client libraries contained in Windows 8.1 and Windows RT 8.1.

Mitigating Factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

To successfully exploit the vulnerability, an attacker would have to host a specially crafted VPN server and then convince users to connect to that server directly (or by way of a redirect to the specially crafted VPN server). In all cases, an attacker would have no way to force users to connect to the specially crafted VPN server.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.
Previous Updates

On May 5, 2014, Microsoft released an update for the Juniper Networks Windows In-Box Junos Pulse VPN client. The update addresses the vulnerability described in Juniper Security Advisory JSA10623. For more information about this update, including download links, see Microsoft Knowledge Base Article 2962393. Note Updates for Windows RT 8.1 are available via Windows Update.

Other Information

Microsoft Active Protections Program (MAPP)
To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback
You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

Customers in the United States and Canada can receive technical support from Security Support. For more information about available support options, see Microsoft Help and Support.

International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit International Support.

Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions
V1.0 (May 5, 2014): Advisory published.
V2.0 (June 9, 2015): Added the 3062760 update to the Juniper VPN Client Update section.

Page generated 2015-06-03 14:02Z-07:00.


- wong chee tat :)

Update Tuesday Overview: July 2014

- wong chee tat :)

June 2014 Security Bulletin Webcast

- wong chee tat :)

May 2014 Security Bulletin Webcast

- wong chee tat :)

April 2014 Security Bulletin Webcast

- wong chee tat :)

Microsoft Security Bulletin Summary for March 2014

Microsoft Security Bulletin Summary for March 2014

Published: Tuesday, March 11, 2014

Version: 1.0

This bulletin summary lists security bulletins released for March 2014.

With the release of the security bulletins for March 2014, this bulletin summary replaces the bulletin advance notification originally issued March 6, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.

For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications.

Microsoft is hosting a webcast to address customer questions on these bulletins on March 12, 2014, at 11:00 AM Pacific Time (US & Canada). Register now for the March Security Bulletin Webcast.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

Bulletin Information

Executive Summaries

The following table summarizes the security bulletins for this month in order of severity.

For details on affected software, see the next section, Affected Software.

Bulletin ID	Bulletin Title and Executive Summary	Maximum Severity Rating and Vulnerability Impact	Restart Requirement	Affected Software
MS14-012	Cumulative Security Update for Internet Explorer (2925418) This security update resolves one publicly disclosed vulnerability and seventeen privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Critical Remote Code Execution	Requires restart	Microsoft Windows, Internet Explorer
MS14-013	Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (2929961)  This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted image file. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.	Critical Remote Code Execution	May require restart	Microsoft Windows
MS14-015	Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2930275) This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.	Important Elevation of Privilege	Requires restart	Microsoft Windows
MS14-016	Vulnerability in Security Account Manager Remote (SAMR) Protocol Could Allow Security Feature Bypass (2934418) This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if an attacker makes multiple attempts to match passwords to a username.	Important Security Feature Bypass	Requires restart	Microsoft Windows
MS14-014	Vulnerability in Silverlight Could Allow Security Feature Bypass (2932677) This security update resolves a privately reported vulnerability in Microsoft Silverlight. The vulnerability could allow security feature bypass if an attacker hosts a website that contains specially crafted Silverlight content that is designed to exploit the vulnerability, and then convinces a user to view the website. In all cases, however, an attacker would have no way to force users to visit a website. Instead, an attacker would have to convince users to visit a website, typically by getting them to click a link in an email message or in an Instant Messenger message that takes them to the attacker's website. It could also be possible to display specially crafted web content by using banner advertisements or by using other methods to deliver web content to affected systems.	Important Security Feature Bypass	Does not require restart	Microsoft Silverlight

Top of section

Exploitability Index

Affected Software

Detection and Deployment Tools and Guidance

Other Information

Microsoft Windows Malicious Software Removal Tool

For the bulletin release that occurs on the second Tuesday of each month, Microsoft has released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center. No updated version of the Microsoft Windows Malicious Software Removal Tool is available for out-of-band security bulletin releases.

Top of section

Non-Security Updates on MU, WU, and WSUS

For information about non-security releases on Windows Update and Microsoft Update, please see:

• Microsoft Knowledge Base Article 894199: Description of Software Update Services and Windows Server Update Services changes in content. Includes all Windows content.
• Updates from Past Months for Windows Server Update Services. Displays all new, revised, and rereleased updates for Microsoft products other than Microsoft Windows.

Top of section

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners listed in Microsoft Active Protections Program (MAPP) Partners.

Top of section

Security Strategies and Community

Update Management Strategies

Security Guidance for Update Management provides additional information about Microsoft’s best-practice recommendations for applying security updates.

Obtaining Other Security Updates

Updates for other security issues are available from the following locations:

• Security updates are available from Microsoft Download Center. You can find them most easily by doing a keyword search for "security update".
• Updates for consumer platforms are available from Microsoft Update.
• You can obtain the security updates offered this month on Windows Update, from Download Center on Security and Critical Releases ISO CD Image files. For more information, seeMicrosoft Knowledge Base Article 913086.

IT Pro Security Community

Learn to improve security and optimize your IT infrastructure, and participate with other IT Pros on security topics in IT Pro Security Community.

Top of section

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

MS14-012

• lokihardt@ASRT, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0297)
• Amol Naik, working with VeriSign iDefense Labs, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0297)
• lokihardt@ASRT, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0298)
• Jose A. Vazquez of Yenteasy - Security Research, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0299)
• Bo Qu of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0302)
• Bo Qu of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0303)
• Hui Gao of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0304)
• Tianfang Guo of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0305)
• Jason Kratzer, working with VeriSign iDefense Labs, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0306)
• Jason Kratzer, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0307)
• lokihardt@ASRT, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0308)
• Amol Naik, working with VeriSign iDefense Labs, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0309)
• Scott Bell of Security-Assessment.com for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0311)
• Yujie Wen of Qihoo for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0311)
• Simon Zuckerbraun, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0312)
• Omair, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0313)
• Bo Qu of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0314)
• Zhibin Hu of Qihoo for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0314)
• Anil Aphale for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0314)
• Bo Qu of Palo Alto Networks for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0321)
• Yujie Wen of Qihoo for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0321)
• FireEye, Inc. for working with us on the Internet Explorer Memory Corruption Vulnerability (CVE-2014-0322)

For MS14-013

• An anonymous researcher, working with VeriSign iDefense Labs, for reporting the DirectShow Memory Corruption Vulnerability (CVE-2014-0301)

For MS14-014

• NSFOCUS Information Technology Co., Ltd. for reporting the Silverlight DEP/ASLR Bypass Vulnerability (CVE-2014-0319)

For MS14-015

• Alexander Chizhov for working with us on the Win32k Information Disclosure Vulnerability (CVE-2014-0323)

For MS14-016

• Andrew Bartlett of the Samba Team and Catalyst IT for reporting the SAMR Security Feature Bypass Vulnerability (CVE-2014-0317)

Top of section

Support

• The affected software listed has been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
• Security solutions for IT professionals: TechNet Security Troubleshooting and Support
• Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
• Local support according to your country: International Support

Top of section

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Top of section

Revisions

• V1.0 (March 11, 2014): Bulletin Summary published.

Top of section

Top of page

- wong chee tat :)

Update Tuesday Overview: March 2014

- wong chee tat :)

Microsoft Security Bulletin Advance Notification for February 2014

Published: Thursday, February 06, 2014

Version: 1.0

This is an advance notification of security bulletins that Microsoft is intending to release on February 11, 2014.
This bulletin advance notification will be replaced with the February bulletin summary on February 11, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification.
To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications.
Microsoft will host a webcast to address customer questions on the security bulletins on February 12, 2014, at 11:00 AM Pacific Time (US & Canada). Register now for the February Security Bulletin Webcast.
Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

Bulletin Information

Executive Summaries

Affected Software

Detection and Deployment Tools and Guidance

Other Information

Microsoft Windows Malicious Software Removal Tool

Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

Top of section

Non-Security Updates on MU, WU, and WSUS

For information about non-security releases on Windows Update and Microsoft Update, please see:

• Microsoft Knowledge Base Article 894199: Description of Software Update Services and Windows Server Update Services changes in content. Includes all Windows content.
• Updates from Past Months for Windows Server Update Services: Displays all new, revised, and rereleased updates for Microsoft products other than Microsoft Windows.

Top of section

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Top of section

Security Strategies and Community

Update Management Strategies
Security Guidance for Update Management provides additional information about Microsoft’s best-practice recommendations for applying security updates.
Obtaining Other Security Updates
Updates for other security issues are available from the following locations:

• Security updates are available from Microsoft Download Center. You can find them most easily by doing a keyword search for "security update".
• Updates for consumer platforms are available from Microsoft Update.
• You can obtain the security updates offered this month on Windows Update, from Download Center on Security and Critical Releases ISO CD Image files. For more information, see Microsoft Knowledge Base Article 913086.

IT Pro Security Community
Learn to improve security and optimize your IT infrastructure, and participate with other IT Pros on security topics in IT Pro Security Community.

Top of section

Support

• The affected software listed has been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
• Security solutions for IT professionals: TechNet Security Troubleshooting and Support
• Help protect your computer that is running Windows from viruses and malware: Virus and Security Solution Center
• Local support according to your country: International Support

Top of section

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Top of section

Top of page

- wong chee rar :)