Microsoft releases a taxing week of patches

By Susan Bradley Digitally signed software is a system designed to build trust in the applications you install on a PC. Most of us don’t think twice about installing digitally-signed software, but we should — now that malware has made this system less trustworthy.

MS10-019 (978601, 979309)
Signed software may install more than advertised

In my first Patch Watch item, I’m showcasing a trust exploit, not a browser exploit. PC users regularly install digitally-signed software, trusting that it’s clean, safe, and what the vendor intended to provide. Microsoft security bulletin MS10-019 includes two updates to fix problems in Windows Authenticode and Windows Cabinet File Viewer. Without these two patches, it’s possible for you to unwittingly install infected software that bears a seemingly genuine digital signature.

While that sounds extremely scary, I’ll remind you that all too often we merrily install unsigned apps. We’ve all seen the warning shown in Figure 1. I myself recently added an unsigned Microsoft hotfix to my Windows 7 machine. The truth is, Microsoft tech support regularly sends fixes by e-mail and includes patch installers with no digital signatures. Almost without fail, I simply go ahead and install the hotfix.

Figure 1. An example of unsigned files from Microsoft.

The affected systems that are patched by MS10-019 are those running:

• Windows XP SP2 and SP3
  
• XP Pro x64 Edition SP2
  
• Vista, Vista SP1 and SP2, 32- and 64-bit versions
  
• Windows 7, 32- and 64-bit versions
  
• Windows Server 2008 and Server 2008 R2
  

► What to do: Don’t panic — just install the two patches in security bulletin MS10-019, as you do other critical updates from Microsoft. Do be aware that hackers have found ways to spoof signed files. Don’t immediately trust downloads from unfamiliar sites just because they have a digital signature.

MS10-026 (977816) and MS10-027 (979402)
Patch now to protect against drive-by downloads

I’m discussing security bulletins MS10-026 and MS10-027 together in this item. Although the two bulletins patch different flaws, they address similar attacks on Microsoft MPEG codecs and Media Player — the now-familiar remote-code execution problem.

Related posts:

1. Microsoft releases an emergency patch for IE
2. More than just two patches this week
3. Security patches, service releases and updates
4. Patches for IE should be top priority this week
5. Microsoft releases Virtual PC 2007