Hello and welcome to this month’s blog on the Microsoft patch releases. This month we also have a “Patch Tuesday” from Adobe, and Oracle is releasing their quarterly “Critical Patch Update.”

Microsoft’s patches

This is a very light month for Microsoft. The vendor released one bulletin covering a “critical” vulnerability that affects Embedded OpenType (EOT) Font. This is a user-level, client-side issue that requires a victim to view a Web page containing malicious content or to open a malicious file.

Adobe’s patches

Adobe is releasing a security update for Reader and Acrobat. Adobe rates these issues “Critical” and urges users to update as soon as possible. In this release, the vendor is addressing the zero-day issue that was first made public December 14, 2009. Exploit code for this issue is available and active exploits have been detected.

Oracle patches

Oracle is releasing their...

When I worked at a small business the IT guy also took care of the phone system, assembled bookcases if needed, and occasionally worked the front desk when the receptionist was on break. In a small business everyone wears many hats and you often don’t really have the skills necessary to do everything asked of you all that well. Or if you do, you probably don’t have the time.

But certainly small and medium businesses understand the importance of computer security and make sure they take all the steps necessary to protect their business from the potentially devastating losses of cybercrime! Well, that’s half right. According to a survey done last year by Symantec, SMBs know security is important but they are not taking proper steps to protect themselves. In fact, a stunning 33 percent of SMBs don’t even run basic antivirus software.

The SMBs surveyed said they don’t have the staffing, budget, or bandwidth to properly protect themselves. And...

We have recently learned of yet another zero-day exploit in Adobe Acrobat. This time it's an overflow for a special type parameter in a function provided by the multimedia.api plugin that can be manipulated from JavaScript in the following manner:

media.newPlayer(null)

Somewhere deep in newPlayer, deinit_obj is set as the handler for deleting the object when it's no longer needed:

And eventually deinit_obj calls the destroy function from the object's v_table:

...

Hello and welcome to this month’s blog on the Microsoft patch releases. This month we also have a "Patch Tuesday" from Adobe.

Microsoft's patches

Microsoft released six security bulletins to address 12 vulnerabilities; seven are rated "critical." The critical issues affect Internet Explorer, Project, and Internet Authentication Service (IAS). Attackers could exploit the IAS remotely, without any interaction from victims. For the other issues, a user must visit a malicious Web page or open a malicious file.

The remaining issues, rated “Important” and “Moderate,” affect IAS, WordPad, Word, Active Directory Federated Services, and Windows LSASS.

Adobe's patches

Adobe is scheduled to release security updates for Flash Player and AIR (Adobe Integrated Runtime). Although both of the updates scheduled for release today are classified as "critical," all customers should apply the Flash Player update immediately because...