Microsoft patches critical security holes in Windows, Office, IE

The company issued fixes for 26 security vulnerabilities, including for SQL Server and Exchange

Microsoft has fixed 26 vulnerabilities in its software products, including several considered critical, the company said on Tuesday in its monthly security patch report.

The security holes, described in five critical and four important bulletins, affect multiple products, including Windows, Internet Explorer, Exchange, SQL Server and Office. In the worst-case scenarios, exploits could give attackers control of affected systems.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

The first critical bulletin, labeled MS12-060, involves Windows Common Controls vulnerabilities, which affect Office, SQL Server, other server products and developer tools.

There have been "limited, targeted attacks" to try to exploit this security hole, but no public proof-of-concept code has been made available to Microsoft's knowledge, wrote Microsoft security official Yunsun Wee in a related blog post.

If a user visits a website that contains "specially crafted content" designed to exploit the vulnerability, attackers could execute code remotely on the affected machine. However, users would have to be tricked into visiting such a website. The malicious code can also be sent as an email attachment, but users would need to open the attachment for the attack to work.

Affected products include all supported editions of Office 2003, Office 2007, Office 2010 (except x64-based editions), SQL Server 2000 Analysis Services, SQL Server 2000 (except Itanium-based editions), SQL Server 2005 (except Microsoft SQL Server 2005 Express Edition, but including Microsoft SQL Server 2005 Express Edition with Advanced Services), SQL Server 2008, SQL Server 2008 R2, Commerce Server 2002, Commerce Server 2007, Commerce Server 2009, Commerce Server 2009 R2, Microsoft Host Integration Server 2004 SP 1, Visual FoxPro 8.0, Visual FoxPro 9.0 and Visual Basic 6.0 Runtime.

Microsoft patched a Windows Common Control bug in April that "made everyone sit up and take notice" due to the broad scope of important products it touched, said Andrew Storms, director of security operations at enterprise security vendor nCircle.

"There is some good news this month: that the attack vector associated with the [Windows Common Control] patch is an RTF (rich text format) file, and the victim has to explicitly open the file to allow the exploit. If you can't get this patch rolled out or mitigation applied quickly, you should remind users about the dangers of opening attachments from unknown persons," he said via email.

The second critical bulletin, labeled MS12-052, concerns four issues with IE that aren't known to be under "active attack." If successfully exploited, a malicious hacker could execute code on the affected machine with the privileges of the current user. As with the previous hole, users would need to visit a malicious Web page to fall victim to the attack. This vulnerability is rated critical for IE 6, IE 7, IE 8 and IE 9 on Windows clients and moderate for those same IE versions on Windows servers.

"It's the third month in a row with a new Internet Explorer patch, so Microsoft is really taking advantage of the new ability to release an IE patch more frequently. This probably means there are a lot more IE patches in our collective future, since it's a good bet Microsoft will be tackling their IE backlog post haste," Storms said.

The third critical bulletin, labeled MS12-054, involves three holes in Windows Networking Components related to the Remote Administration Protocol (RAP) and one issue affecting the Print Spooler. The vulnerabilities could allow malicious hackers to launch denial-of-service attacks and execute code remotely on the affected machine, among other scenarios. Microsoft hasn't received reports that these holes have been exploited.

The issue is critical for all supported editions of Windows XP and Windows Server 2003; important for all supported editions of Windows Vista; and moderate for all supported editions of Windows Server 2008, Windows 7 and Windows 2008 R2.

"This is something that predominantly affects small business and campus locations where Windows computers are configured in workgroups. If this describes your business, deploy this patch as soon as you can," Storms said.

A fourth critical vulnerability, MS12-053, affects the Windows Remote Desktop Protocol and can be exploited by attackers who send a sequence of "specially crafted" RDP packets to an affected system. RDP isn't turned on by default on any Windows OS. This hole is rated critical for all supported editions of Windows XP.

This bug has "a potential wormable condition" and could cause serious harm because it is "network aware" and requires no authentication, Storms said. "If you have XP on your network, then get the mitigations for this one installed ASAP," he said.

A fifth critical vulnerability, MS12-058, relates to Exchange Server's WebReady Document Viewing feature. The exploit could allow execution of remote code on the affected system. Users would need to preview a malicious file using Outlook Web App. This is rated critical for all supported editions of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010.

This fix closes the loop on a security advisory Microsoft issued in July, in which it explained that the existence of the vulnerabilities was due to the way files are parsed by Oracle Outside In code libraries. Oracle had fixed the security holes in its product earlier in July.

"This vulnerability really never went anywhere in the exploit community. We have so far seen very little uptake on actively exploiting the bug," Storms said.

The four vulnerabilities rated important are MS12-055, related to Windows kernel-mode drivers, which would allow for unauthorized elevation of user privilege; MS12-056, a vulnerability in the JScript and VBScript scripting engines on 64-bit versions of Windows, which could allow remote code execution if users visit a malicious website; MS12-057, a hole in Office that could lead to remote code execution if a user opens a malicious file or embeds a malicious Computer Graphics Metafile (CGM) graphics file into an Office file; and MS12-059, a vulnerability in Visio that also could lead to remote code execution on an affected machine.

Wolfgang Kandek, CTO at enterprise security vendor Qualys, said CSOs and IT professionals should give top priority to the Windows Common Controls patch, which is already being targeted by attackers. "A second important vulnerability to address is MS12-058 for IT Admins that are responsible for Exchange servers," he said via email.

Microsoft also announced a change in the way Windows deals with certificates whose RSA keys are under 1024 bits in length. A Windows update will restrict the use of such certificates. That update is now in the Download Center as well as the Microsoft Update Catalog so that enterprise administrators can download it and test it. The update will be widely released via Windows Update in October of this year.

Users whose machines are set up to receive Microsoft's software patches automatically don't need to do anything. The fixes will be installed on their computers automatically. The updates can also be manually downloaded at the Microsoft Update and Windows Update sites.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Exam 70-599 – Designing and Developing Windows Phone 7 Applications to be available from July 14 ,2011

In one of my earlier posts , i mentioned that MCTS Exam – ( 70-599 ) – Pro: Designing and Developing Windows Phone 7 Applications is in the process , It looks like the approximate date when the exam will be published is mentioned in Microsoft Learning portal

Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com

The MCTS 70-599 is designed to test the candidate’s knowledge and skills on designing and developing Applications for Windows Phone 7 Platform .

The Candidates for Exam 70-599 are typically “ISV’s” or developers who work in an oirganisation designing and developing consumer applications for Windows Phone 7 .
The MCTS 70-599 counts as a credit for the following exam Microsoft Certified Professional Developer: Windows Phone 7, Developer .

This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam.

Designing Data Access Strategies (19%)

Send and receive data.
This objective may include but is not limited to: design connection mechanisms for communicating with external web services; plan how to consume and parse data from web services (for example, WCF and WS*); ensure a trusted transfer of data to and from a phone
Design a data storage strategy.
This objective may include but is not limited to: differentiate between persistent and transient data; determine when to use isolated storage; plan for size limitations of isolated storage; design cloud-based storage
Plan for bandwidth limitations and implement network connectivity detection.
This objective may include but is not limited to: plan for disconnected scenarios; plan for low network bandwidth

Designing and Implementing Notification Strategies (17%)

Plan for and implement push notifications in the application.
This objective may include but is not limited to: choose method for notifying user of application’s state/status (tile, toast, RAW); respond to notifications; registration for notifications
Plan for and implement push notifications on the server.
This objective may include but is not limited to: when to use toast, tile, and raw; plan for receiving the unique device URL
Create and update live tiles.
This objective may include but is not limited to: update background image, numbers, and text

Working with Platform APIs, Tasks, and Choosers (21%)

Design and implement sensor interaction.
This objective may include but is not limited to: choose which sensors are appropriate for your application; design location awareness (when to use different levels of GeopositionAccuracy); location awareness system setting
Plan for and implement the use of Tasks and Choosers.
Plan for and implement multitouch and gestures.
This objective may include but is not limited to: manipulation events (ManipulationStarted, ManipulationCompleted, ManipulationDelta)
Design and implement application navigation.
This objective may include but is not limited to: pass parameters (NavigationContext API), manipulate the navigation stack (NavigationService API), use of the Back button, PhoneApplicationPage class and PhoneApplicationFrame class and the difference between these two classes

Designing the Application Architecture (21%)

Design for threading.
This objective may include but is not limited to: use of the composition thread
Monitor and tune performance.
This objective may include but is not limited to: frame rate counter; cache visualization; redraw regions; bitmap caching; memory usage limitations; plan for power consumption; tune bandwidth consumption; performance counters
Manage the application life cycle.
This objective may include but is not limited to: tombstoning; response to PhoneApplicationService events (Launching, Activated, Deactivated, Closing)
Prepare the application to meet Windows Phone 7 marketplace requirements.
This objective may include but is not limited to: Windows Phone 7 Application Certification Requirements; design for localization and globalization; plan for trial versions; work with WMAppManifest.xml; design for icon requirements for marketplace

Designing the User Interface and User Experience (23%)

Design for separation of concerns.
This objective may include but is not limited to: presentation patterns that use view models, MVVM
Design Windows Phone 7 control usage.
This objective may include but is not limited to: design control usage as described in UI Design and Interaction Guide for Windows Phone 7; design proper use of PanoramaControl and PivotControl; choose when to use the Panorama Control and PivotControl; recommend when to use ApplicationBar
Recommend keyboard layout for a given situation.
This objective may include but is not limited to: InputScope property
Design for system themes, accent color, and screen orientation.
This objective may include but is not limited to: built-in styles that use system themes and accent colors, ApplicationBar icons (size, transparency), landscape, portrait

Also note that there currently no training , Microsoft Press books like Self training kit or practice tests but these should be made available when the exam is published .

I did get an Beta Invite for the above exam sometime back , but sadly there was a region restriction . I reside in India and hence could not take up the Beta Exam .

Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com

Microsoft unveils touch-oriented Windows 8

Microsoft calls it a 'reimagining' of Windows that will run on everything from small devices to large-screen PCs (see video below)

IDG News Service - Microsoft today showed the next version of its Windows OS at a press event in Taipei, unveiling a completely new tile-based interface that it hopes will be better suited for the emerging world of tablet PCs.

Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com

Microsoft called it a "reimagining" of Windows that will run on all types of devices from small, touch-sensitive screens to traditional large-screen PCs, and that can be used with or without a keyboard and mouse.

It is intended partly to improve Microsoft's position in the emerging tablet PC market, where Windows 7 has struggled to compete effectively with operating systems from Google and Apple. But the new interface is intended for use on all types of PCs.

Microsoft showed several prototype systems on stage running the software, including tablets, laptops and all-in-one PCs. The new interface is a significant departure from the traditional Windows desktop that Microsoft has relied on for decades.
Windows 8

A deep dive into Windows 8 Developer Preview
Metro apps to be sold only from Microsoft's app store
Visual tour: Windows 8 goes Metro
Microsoft CEO hints at 'Metro-ization' of Office
Windows 8 snags an early thumbs-up
Echoing Apple, Microsoft bans Flash from Metro IE10 in Windows 8
10 best new features of Windows Server 8
Will tablet developers rush to Windows 8?
Microsoft: No Windows Server for ARM
Microsoft previews next Windows Server

Continuing coverage: Windows 8

The start screen now has several large, colored application icons that look similar to those on Microsoft's new Windows Phone 7 OS. Tapping an icon with a finger launches the application and allows it to take up the entire screen, without the usual Windows menus, system tray and scroll bars around the edges of the screen.

"The application comes quickly to life as Windows fades to the background," said Michael Angiulo, corporate vice president of Windows planning, hardware and ecosystem, who demonstrated the new software here.

"The tiles on the start screen are live -- they represent your people, your applications, your contacts, the information you care the most about," he said. "You can group them, arrange them and name them as you like, so that first start screen experience is really personal."

The application tiles display new information from the Web automatically, such as Twitter and e-mail messages, or news items from a news reader, he said.

These Web-friendly applications, which Microsoft calls tailored apps, are built on a new Windows 8 development platform and relies heavily on Internet Explorer 10, which will ship with the new OS, and also on HTML 5, Javascript and CSS.

Ten years of Windows XP: how longevity became a curse

Windows XP's retail release was October 25, 2001, ten years ago today. Though no longer readily available to buy, it continues to cast a long shadow over the PC industry: even now, a slim majority of desktop users are still using the operating system.

Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com

Windows XP didn't boast exciting new features or radical changes, but it was nonetheless a pivotal moment in Microsoft's history. It was Microsoft's first mass-market operating system in the Windows NT family. It was also Microsoft's first consumer operating system that offered true protected memory, preemptive multitasking, multiprocessor support, and multiuser security.

The transition to pure 32-bit, modern operating systems was a slow and painful one. Though Windows NT 3.1 hit the market in 1993, its hardware demands and software incompatibility made it a niche operating system. Windows 3.1 and 3.11 both introduced small amounts of 32-bit code, and the Windows 95 family was a complex hybrid of 16-bit and 32-bit code. It wasn't until Windows XP that Windows NT was both compatible enough—most applications having been updated to use Microsoft's Win32 API—and sufficiently light on resources.

In the history of PC operating systems, Windows XP stands alone. Even Windows 95, though a landmark at its release, was a distant memory by 2005. No previous PC operating system has demonstrated such longevity, and it's unlikely that any future operating system will. Nor is its market share dominance ever likely to be replicated; at its peak, Windows XP was used by more than 80 percent of desktop users.

The success was remarkable for an operating system whose reception was initially quite muted. In the wake of the September 11th attacks, the media blitz that Microsoft planned for the operating system was toned down; instead of arriving with great fanfare, it slouched onto the market. Retail sales, though never a major way of delivering operating systems to end users, were sluggish, with the operating system selling at a far slower rate than Windows 98 had done three years previously.

It faced tough competition from Microsoft's other operating systems. Windows 2000, released less than two years prior, had won plaudits with its marriage of Windows NT's traditional stability and security to creature comforts like USB support, reliable plug-and-play, and widespread driver support, and was widely adopted in businesses. For Windows 2000 users, Windows XP was only a minor update: it had a spruced up user interface with the brightly colored Luna theme, an updated Start menu, and lots of little bits and pieces like a firewall, UPnP, System Restore, and ClearType. Indeed, many professionals and, for want of a better term, nerds, were turned off by the Luna theme, with its detractors dismissing Windows XP as a Fisher-Price operating system.
The familiar Windows XP desktop with Luna theme
The familiar Windows XP desktop with Luna theme

For home users using Windows 95-family operating systems, Windows XP had much more to offer, thanks to its substantially greater stability and security, especially once Service Pack 2 was released. But even there, users didn't leap immediately. Windows XP's hardware demands, though modest by today's standards, were steeper than those of the Windows 95 family, and in its early days at least, neither Windows XP's driver support nor performance could match those of its technologically inferior sibling. Gamers, in particular, were vocal in their criticism of Windows XP, and many vowed to stick with Windows 98SE indefinitely.

In the first year of Windows XP's availability, Microsoft had to work to persuade even enterprises to ditch Windows 95, in spite of its near complete unsuitability to enterprise computing.

In the end, none of the objections mattered. Time made Windows XP a success. Computers got faster, rendering its hardware demands first ubiquitous, and then later in its life, almost laughable. Driver support grew, and driver performance improved. Instead of being a heavyweight alternative to use if you had the resources and you could be sure that all your hardware and software would work with it, it became the obvious choice of system software. The explosion in Internet usage, and the focus on system security, made continued use of the Windows 95 family untenable. Windows XP was therefore the only choice for most desktop users, and within a few years of its release, most Windows 95, Windows 98, Windows NT 4, and Windows 2000 users had made the switch.