DigitMemo.com

Over 1000 patches and all-new features, and a new activation model.

Following our coverage of the Windows XP SP3 beta leak almost a month ago in August, here’s some more info on the official beta, which just had its first authorized distributable released earlier today. Say hello to Windows XP SP3, build 3205!

Along with the standalone installer redistributables, Microsoft also provided the usual release notes and a list of all the hotfixes included in this release. Contrary to popular belief, Windows XP SP3 does ship with all-new features - not just patches and hotfixes, most of them backported from Windows Vista:

• New Windows Product Activation model: no need to enter product key during setup. Thank God for that!
• Network Access Protection modules and policies have been brought to XP after being one of the more-well-received features in Windows Vista. You can read more about NAP here.
• New Microsoft Kernel Mode Cryptographic Module - the Windows XP SP3 kernel now includes an entire module that provides easy access to multiple cryptographic algorithms and is available for use in kernel-mode drivers and services.
• New “Black Hole Router” detection - Windows XP SP3 can detect and protect against rogue routers that are discarding data.

Click for more on Windows XP SP3 Build 3205 Released w/ New Features »

The November security updates fix the so-called URI problem, a critical Windows bug that has been exploited by online criminals.

Microsoft has released its November security updates, fixing a critical Windows bug that has been exploited by online criminals.

Microsoft released just two security updates this month, but security experts say that IT staff will want to install both of them as quickly as possible. The MS07-061 update is particularly critical because the flaw it repairs has been seen in Web-based attack code, said Amol Sarwate, manager of Qualys’s vulnerability research lab. “This was a zero day [flaw] that was being used in the wild by hackers,” he said

Click for more on Patch Tuesday: Microsoft Fixes Critical Windows Bug »

Microsoft releases a new update for Windows Vista that improves the compatibility, reliability, and stability of the OS.

Download for 32bit Windows Vista(link, WGA Free) and 64bit(link, WGA Free)

This update, detailed in KB941969, resolves the following issues in Windows Vista:

• A compatibility issue that affects some third-party antivirus software applications.
• A reliability issue that occurs when a Windows Vista-based computer uses certain network driver configurations.

Click for more on Windows Update: Vista performance pack and DX9c Nov patch »

Mozilla has released a new patch for Firefox, which will update the browser to version 2.0.0.8

The update, distributed since earlier today via the software’s auto-update feature, patches eight vulnerabilities. Two of them are rated as “critical” and could allow an attacker to run code or install software on a client PC.

The new version brings two new localized versions of Firefox, Georgian and Romanian. Probably most significantly, the browser is now compatible with Apple’s Leopard operating system. However, Mozilla noted that there are several known “issues” in this version. Among others, “some” media plug-ins as well as add-ons containing binary components are not working properly, the organization said.

Microsoft confirms it has fixed an Excel calculation results bug, but declines to fully explain the cause.

Microsoft says it has fixed an Excel bug, which caused the spreadsheet to display erroneous calculation results, even though it performed the calculation correctly and stored it in Excel’s memory.

Click for more on Microsoft Fixes Excel Calculation Bug »

Microsoft has released the latest monthly security updates for October 2007.

The updates are available for download from the Microsoft Download Center and also from Windows Update/Microsoft Update.

Critical:

• KB923810
  Vulnerability in Kodak Image Viewer Could Allow Remote Code Execution
• KB941202
  Security Update for Outlook Express and Windows Mail
• KB939653
  Cumulative Security Update for Internet Explorer
• KB942695
  Vulnerability in Microsoft Word Could Allow Remote Code Execution

Important:

• KB933729
  Vulnerability in RPC Could Allow Denial of Service
• KB942017
  Vulnerability in Windows SharePoint Services 3.0 and Office SharePoint Server 2007 Could Result in Elevation of Privilege Within the SharePoint Site

Microsoft has also released the usual update for the Windows Malicious Software Removal Tool and the Windows Mail Definition Update (x86) (x64).

The flaw, which affects Windows XP and Windows Vista machines, opens up a backdoor that could enable a hacker to break into Firefox.

The company released an update for the Windows version of QuickTime media player on Wednesday afternoon to patch what Apple calls a “command injection issue” in the way the media player handles URLs. The flaw, which affects Windows XP and Windows Vista, was first disclosed in September of 2006 by Petko D. Petkov, a penetration tester.

Click for more on Apple Finally Patches Year-old QuickTime Flaw »

Available from Microsoft today, for Windows XP, 2003 and Vista.

Check them out if you have encountered any of the problems described.

For Windows XP

KB931678

Install this update to resolve an issue where an access violation may occur when a pop-up window in Internet Explorer 7 is closed on a system running Windows XP with Service Pack 2. After you install this item, you may have to restart your computer.

A new zero-day vulnerability involving Windows XP reported today. This flaw could potentially allow a system to be remotely compromised.

The culprit in this instance involves the implementation of the “FindFile()” in the mfc42.dll and mfc42u.dll files bundled with the operating system. These files are still likely to be linked to by older applications.

Excerpt from Secunia:

The vulnerability is caused due to a boundary error in the “FindFile()” function of the CFileFind class in mfc42.dll and mfc42u.dll. This can be exploited to cause a heap-based buffer overflow by passing an overly long argument to the affected function.

Successful exploitation may allow execution of arbitrary code.

No patches have been announced for this vulnerability yet. It is recommended for applications using this vulnerable library to first check the length of the user input before passing it to the affected function.

The ICS is buggy in Vista and might lead to random connection drops.

When ICS service is Enabled, after a few hours (no specified time frame, might happen anytime) the connections on Vista PC running ICS would down and no more new connection can be made, while the client PC is still working.

Click for more on Fix the ICS Bug Under Vista »