Skip to main content
MSRC

Month Archives: December 2012

Assessing risk for the December 2012 security updates

Tuesday, December 11, 2012

Today we released seven security bulletins addressing 12 CVE’s. Five of the bulletins have a maximum severity rating of Critical, and two have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max XI Likely first 30 days impact Platform mitigations and key notes MS12-077(Internet Explorer) Victim browses to a malicious webpage.

It’s That Time of Year, For the December 2012 Bulletin Release

Tuesday, December 11, 2012

Happy holidays! I hope everyone is enjoying the festive season. I like to get my holiday shopping done early, and this year was no exception. In the middle of my holiday shopping last week, as I passed my cash from one store to the next, I was reminded of “Pass-the-Hash.” (My mind does tend to wander a bit as I shop.

MS12-083: Addressing a missing certificate revocation check in IP-HTTPS

Tuesday, December 11, 2012

MS12-083 is being released to address a Security Feature Bypass, a class of vulnerability for which we do not frequently release security updates. This is the third such instance, with MS12-001 and MS12-032 previously having addressed Security Feature bypasses. The security feature being bypassed in the case of MS12-083 is the revocation check in IP-HTTPS.