Risk Assessment

Security Advisory 983438 Released

Hello. Today we released Security Advisory 983438, addressing a cross-site scripting (XSS) vulnerability in SharePoint Server 2007 and SharePoint Services 3.0 that could allow Elevation of Privilege (EoP) within the SharePoint site itself. Servers are at reduced risk from Internet Explorer 8 clients, as the Internet Explorer 8 XSS filter helps to mitigate the issue …

Security Advisory 983438 Released Read More »

Update on MS10-025

I wanted to give customers an update on the status of MS10-025. First, I want to reiterate that this issue affects only Windows 2000 Servers in a non-default configuration: Windows Media Services needs to be installed. Customers who do not have Windows Media Services installed are not affected and were not offered this update. Shortly …

Update on MS10-025 Read More »

Guidance on Internet Explorer XSS Filter

The XSS Filter related Blackhat EU presentation discussed a vulnerability that was previously disclosed and addressed in the January security update to Internet Explorer (MS10-002). This attack scenario involved modified HTTP responses, enabling XSS on sites that would not otherwise be vulnerable.    An additional update to the IE XSS Filter is currently scheduled for …

Guidance on Internet Explorer XSS Filter Read More »

BlueHat Security Forum: Buenos Aires Edition–Shipping!

Handle:Silver Surfer IRL: Mike Reavey Rank: Director, MSRC Likes: Warm weather, Battlestar Galactica, and responsibly reported vulnerabilities Dislikes: Rain, Rain without end, Clouds with potential for rain, reality TV, and unpatched vulns I’m here at the second edition of the BlueHat Security Forum, this time in Buenos Aires. So far it is shaping up to …

BlueHat Security Forum: Buenos Aires Edition–Shipping! Read More »

Who Gets It and Who Doesn’t? (Windows Genuine Advantage and Security Updates)

Handle:Mando Picker IRL: Dustin Childs Rank: Security Program Manager Likes: Protecting customers, working with security researchers, second Tuesdays, bourbon, mandolins Dislikes: Using “It’s hard” as an excuse, quitting when it gets tough, banjos One of the things I get to do in the Microsoft Security Response Center (MSRC) is talk to our customers and tell …

Who Gets It and Who Doesn’t? (Windows Genuine Advantage and Security Updates) Read More »

Snowpacalypse Now (I love the smell of briefings in the morning)

Handle:Avatar IRL: Karl Hanmore Rank: Senior Security Strategist (aka Sergeant Grunt) Likes: Getting the job done, bringing the fight to the bad guys, good single malt whiskey Dislikes: Cowards, talkers not doers, red tape, humidity Handle:Mando Picker IRL: Dustin Childs Rank: Security Program Manager Likes: Protecting customers, working with security researchers, second Tuesdays, bourbon, mandolins …

Snowpacalypse Now (I love the smell of briefings in the morning) Read More »

BlueHat Security Forum: Buenos Aires Edition

Handle:C-Lizzle IRL: Celene Temkin Rank: Program Manager 2 & BlueHat Project Manager Likes: Culinary warfare, BlueHat hackers and responsible disclosure Dislikes: Acts of hubris, MySpace, orange mocha Frappaccinos! Hey Everyone! What speaks English, Portuguese and Spanish, has a hundred set of eyes, and battles in the defense of good against evil on a daily basis? …

BlueHat Security Forum: Buenos Aires Edition Read More »

There were dragons. Everywhere.

Handle:volty IRL: Joe Hemmerlein Rank: Security Grunt (aka Security Program Manager) Likes: Quality engineering, diverting things from their intended use, processes and tools Dislikes: Meat, speed limits, getting up in the morning Guten Morgen! Joe Hemmerlein hier vom Microsoft Security Response Center (MSRC). I just returned from Germany earlier this month, where I spent some …

There were dragons. Everywhere. Read More »

Security Advisory 979352 – Going out of Band

We wanted to provide a quick update on the threat landscape and announce that we will release a security update out-of-band to help protect customers from this vulnerability. Based on our comprehensive monitoring of the threat landscape we continue to see very limited, and in some cases, targeted attacks.  To date, the only successful attacks that …

Security Advisory 979352 – Going out of Band Read More »