Spyware, viruses, & security forum: Microsoft Security Bulletin Summary for June 2012

Angela Gunn @ the Microsoft Security Response Center blog:

For Update Tuesday we're releasing seven security bulletins - three Critical-class and four Important - addressing 26 unique CVEs to further improve the security postures of Microsoft Windows, Internet Explorer, Dynamics AX, Microsoft Lync, and the Microsoft .NET Framework. In addition to the security bulletins, we are releasing an automatic updater feature for Windows Vista and Windows 7 untrusted certificates.

This new automatic updater feature provides a mechanism that allows Windows to specifically flag certificates as untrusted. With this new feature, Windows will check daily for updated information about certificates that are no longer trustworthy. In the past, movement of certificates to the untrusted store required a manual update. This new automatic update mechanism, which relies on a list of untrusted certificates known as a Disallowed Certificate Trust List (CTL), is detailed on the PKI blog. We encourage all customers to install this new feature immediately.

Adding to our defense-in-depth measures, in August, we will release a change to how Windows manages certificates that have RSA keys of less than 1024 bits in length. Once this key length update is released, we will treat all of these certificates as invalid, even if they are currently valid and signed by a trusted certificate authority. We're announcing this now to allow folks time to make needed adjustments. Further information on this change can be found on the PKI blog.

Customers should plan to install all of these updates as soon as possible. For those who must prioritize deployment, we recommend focusing on the following two Critical updates first:

MS12-037 (Internet Explorer): This security update addresses 13 issues affecting all supported versions of IE. The maximum severity for these issues is Critical and could result in remote code execution. To ensure protection all updates from this bulletin must be applied. We recommend that customers read through the bulletin information concerning MS12-037 and apply it as soon as possible.

MS12-036 (RDP): This security update addresses one Critical issue affecting all supported versions of Microsoft Windows that could result in remote code execution. Attack vectors for this issue include maliciously crafted websites and email. We recommend that customers read through the bulletin information concerning MS12-036 and apply it as soon as possible.

We're also issuing Security Advisory 2719615 today. It includes information on and mitigations for a recently disclosed Remote Code Execution issue involving MSXML Core Services, which is part of Windows and other products. Our investigation is still underway, but we have already developed an effective workaround that stops would-be attackers from taking advantage of the issue via Internet Explorer. We're pleased to offer it as an easy-to-deploy, no-reboot-required Fix it in Security Advisory 2719615 for anyone who, after reading about the issue, believes they might be at risk.

Continued : http://blogs.technet.com/b/msrc/archive/2012/06/12/certificate-trust-list-update-and-the-june-2012-bulletins.aspx