1. Information About Microsoft Out-of-Band Security Bulletins

2. What We Will Cover Review of Out-of-Band release:Review of Out-of-Band release: –New Security Bulletin –New Security Advisory ResourcesResources Questions and answersQuestions and answers

3. MS10-002: Cumulative Security Update for Internet Explorer (978207) CVESeverityExploitabilityCommentNote CVE-2009-4074Moderate1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0027Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0244Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0245Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0246Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0247Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0248Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE-2010-0249Critical1 Consistent exploit code likely. RCE Publicly disclosed Affected Products All currently supported versions of Windows and Internet Explorer Deployment Priority 1 Main Target Workstations and Terminal Servers Possible Attack Vectors An attacker could host a specially crafted website designed to exploit these vulnerabilities through Internet Explorer.An attacker could host a specially crafted website designed to exploit these vulnerabilities through Internet Explorer. This constitutes a browse and own scenario.This constitutes a browse and own scenario. Impact of Attack An attacker who successfully exploited this vulnerability would gain the same rights as the logged on user.An attacker who successfully exploited this vulnerability would gain the same rights as the logged on user. Mitigating Factors An attacker would have no way to force a user to visit their malicious website.An attacker would have no way to force a user to visit their malicious website. By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration.By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e- mail messages in the Restricted sites zone.By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e- mail messages in the Restricted sites zone. Additional Information We are aware of targeted attacks against IE 6.We are aware of targeted attacks against IE 6. Windows Server when installed using server core is not affected.Windows Server when installed using server core is not affected.

4. Security Advisory 979682: Vulnerability in Windows Could Allow an Elevation in Privilege Microsoft is investigating new public reports of a vulnerability in the Windows kernel. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time.Microsoft is investigating new public reports of a vulnerability in the Windows kernel. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time. Microsoft released Security Advisory 979682 to provide mitigations and workarounds for this vulnerability.Microsoft released Security Advisory 979682 to provide mitigations and workarounds for this vulnerability. Microsoft is currently working towards an update to address this vulnerability.Microsoft is currently working towards an update to address this vulnerability. Mitigating Factors:Mitigating Factors: –An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. –Windows operating systems for x64-based and Itanium-based computers are not affected. Workaround: Disable the NTVDM subsystem (users will not be able to run 16-bit applications)Workaround: Disable the NTVDM subsystem (users will not be able to run 16-bit applications)

5. Bulletin Windows Update Microsoft Update MBSA 2.1.1 WSUS 3.0 SMS 2003 with SUIT SMS 2003 with ITMU SCCM 2007 MS10-002 YesYesYesYes No 1 YesYes 1.Yes for Internet Explorer 6.0 only in Windows XP SP2, Windows XP SP3 and Windows Server 2003 SP2 Detection & Deployment

6. Other Update Information BulletinRestartUninstallReplaces MS10-002 YesYesMS09-072

7. Resources Blogs Microsoft Security Response Center (MSRC) blog: http://blogs.technet.com/msrcMicrosoft Security Response Center (MSRC) blog: http://blogs.technet.com/msrc http://blogs.technet.com/msrc Security Research & Defense blog: http://blogs.technet.com/srdSecurity Research & Defense blog: http://blogs.technet.com/srd http://blogs.technet.com/srd Microsoft Malware Protection Center Blog: http://blogs.technet.com/mmpc/Microsoft Malware Protection Center Blog: http://blogs.technet.com/mmpc/ http://blogs.technet.com/mmpc/ Bulletins, Advisories, Notifications & Newsletters Security Bulletins Summary: www.microsoft.com/technet/security/bulletin/summary. mspxSecurity Bulletins Summary: www.microsoft.com/technet/security/bulletin/summary. mspx www.microsoft.com/technet/security/bulletin/summary. mspx www.microsoft.com/technet/security/bulletin/summary. mspx Security Bulletins Search: www.microsoft.com/technet/security/current.aspxSecurity Bulletins Search: www.microsoft.com/technet/security/current.aspx www.microsoft.com/technet/security/current.aspx Security Advisories: www.microsoft.com/technet/security/advisory/Security Advisories: www.microsoft.com/technet/security/advisory/ www.microsoft.com/technet/security/advisory/ Microsoft Technical Security Notifications: www.microsoft.com/technet/security/bulletin/notify.mspxMicrosoft Technical Security Notifications: www.microsoft.com/technet/security/bulletin/notify.mspx www.microsoft.com/technet/security/bulletin/notify.mspx Microsoft Security Newsletter: www.microsoft.com/technet/security/secnews/Microsoft Security Newsletter: www.microsoft.com/technet/security/secnews/ www.microsoft.com/technet/security/secnews/ Security Centers Microsoft Security Home Page: www.microsoft.com/securityMicrosoft Security Home Page: www.microsoft.com/security www.microsoft.com/security TechNet Security Center: www.microsoft.com/technet/securityTechNet Security Center: www.microsoft.com/technet/security www.microsoft.com/technet/security MSDN Security Developer Center: http://msdn.microsoft.com/en-us/security/default.aspxMSDN Security Developer Center: http://msdn.microsoft.com/en-us/security/default.aspx http://msdn.microsoft.com/en-us/security/default.aspx Other Resources OOB Update Resources:OOB Update Resources: –IT Pro/Enterprise Guidance: www.microsoft.com/technet/security www.microsoft.com/technet/security –Consumer Guidance: http://www.microsoft.com/security/updates/ie.aspx http://www.microsoft.com/security/updates/ie.aspx Update Management Process http://www.microsoft.com/technet/security/guidance/pat chmanagement/secmod193.mspxUpdate Management Process http://www.microsoft.com/technet/security/guidance/pat chmanagement/secmod193.mspx http://www.microsoft.com/technet/security/guidance/pat chmanagement/secmod193.mspx http://www.microsoft.com/technet/security/guidance/pat chmanagement/secmod193.mspx Microsoft Active Protection Program Partners: http://www.microsoft.com/security/msrc/mapp/partners. mspxMicrosoft Active Protection Program Partners: http://www.microsoft.com/security/msrc/mapp/partners. mspx http://www.microsoft.com/security/msrc/mapp/partners. mspx http://www.microsoft.com/security/msrc/mapp/partners. mspx

8. Questions and Answers Submit text questions using the “Ask” button.Submit text questions using the “Ask” button. Don’t forget to fill out the survey.Don’t forget to fill out the survey. A recording of this webcast will be available within 48 hours on the MSRC Blog: http://blogs.technet.com/msrcA recording of this webcast will be available within 48 hours on the MSRC Blog: http://blogs.technet.com/msrc http://blogs.technet.com/msrc Register for next months webcast at: http://microsoft.com/technet/security/current.aspxRegister for next months webcast at: http://microsoft.com/technet/security/current.aspx http://microsoft.com/technet/security/current.aspx