Executive Summariess
วันอังคารที่ 12 ตุลาคม 2553 (ตรงกับวันพุธที่ 13 ตุลาคม 2553 ตามเวลาในประเทศไทย) ไมโครซอฟท์ได้ออก "Microsoft Security Update for October 2010" หรือที่เรียกกันในเหล่าแอดมินว่า "Patch Tuesday" จำนวน 16 อัปเดท เป็นแพตซ์ของระบบ Windows, Internet Explorer, Microsoft Office และ.NET Framework รายละเอียดดังต่อไปนี้
• เป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของระบบ Windows จำนวน 12 ตัว โดยมีแพตซ์ถึง 3 ตัวที่มีความร้ายแรงระดับวิกฤติ แพตซ์ 7 ตัวที่มีความร้ายแรงระดับสูง และมีแพตซ์ 2 ตัวที่มีความร้ายแรงระดับกลาง
• เป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของระบบ Windows และ Internet Explorer จำนวน 1 ตัว เป็นแพตซ์ที่มีความร้ายแรงระดับวิกฤติ
• เป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของระบบ Microsoft Server Software จำนวน 1 ตัว เป็นแพตซ์ที่มีความร้ายแรงระดับวิกฤติ
• เป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของ Microsoft Office จำนวน 2 ตัว เป็นแพตซ์ที่มีความร้ายแรงระดับสูง
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงระดับวิกฤติ (Critical)
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงระดับวิกฤติมีจำนวน 4 ตัว เป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของ Windows จำนวน 3 ตัว และของ Windows และ Internet Explorer อีก 1 ตัว มีรายละเอียดดังต่อไปนี้
MS10-071 - Cumulative Security Update for Internet Explorer (2360131)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-071.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3: Internet Explorer 6, Internet Explorer 7, Internet Explorer 8
- Windows XP Professional x64 Edition Service Pack 2: Internet Explorer 6, Internet Explorer 7, Internet Explorer 8
- Windows Server 2003 Service Pack 2: Internet Explorer 6, Internet Explorer 7, Internet Explorer 8
- Windows Server 2003 x64 Edition Service Pack 2: Internet Explorer 6, Internet Explorer 7, Internet Explorer 8
- Windows Server 2003 with SP2 for Itanium-based Systems: Internet Explorer 6, Internet Explorer 7
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2: Internet Explorer 7, Internet Explorer 8
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2: Internet Explorer 7, Internet Explorer 8
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2: Internet Explorer 7 (Windows Server 2008 Server Core installation not affected), Internet Explorer 8 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2: Internet Explorer 7 (Windows Server 2008 Server Core installation not affected), Internet Explorer 8 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2: Internet Explorer 7
- Windows 7 for 32-bit Systems: Internet Explorer 8
- Windows 7 for x64-based Systems: Internet Explorer 8
- Windows Server 2008 R2 for x64-based Systems: Internet Explorer 8 (Windows Server 2008 R2 Server Core installation not affected)
- Windows Server 2008 R2 for Itanium-based Systems: Internet Explorer 8
MS10-075 - Vulnerability in Media Player Network Sharing Service Could Allow Remote Code Execution (2281679)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-075.mspx
Impact: Remote Code Execution
Affected Software:
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
MS10-076 - Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution (982132)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-076.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation not affected)
- Windows Server 2008 R2 for Itanium-based Systems
MS10-077 - Vulnerability in .NET Framework Could Allow Remote Code Execution (2160841)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-077.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation affected)
- Windows Server 2008 R2 for Itanium-based Systems
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงสูง (Important)
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงสูงมีจำนวน 10 ตัว ทั้งหมดเป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของ Windows มีรายละเอียดดังต่อไปนี้
MS10-072 - Vulnerabilities in SafeHTML Could Allow Information Disclosure (2412048)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-072.mspx
Impact: Information Disclosure
Affected Software:
- Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit versions)
- Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit versions)
- Microsoft SharePoint Foundation 2010
- Microsoft Office SharePoint Server 2007 Service Pack 2 (32-bit editions)
- Microsoft Office SharePoint Server 2007 Service Pack 2 (64-bit editions)
- Microsoft Groove Server 2010
- Microsoft Office Web Apps
MS10-073 - Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-073.mspx
Impact: Elevation of Privilege
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation affected)
- Windows Server 2008 R2 for Itanium-based Systems
MS10-078 - Vulnerabilities in the OpenType Font (OTF) Format Driver Could Allow Elevation of Privilege (2279986)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-078.mspx
Impact: Elevation of Privilege
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
MS10-079 - Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2293194)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-079.mspx
Impact: Remote Code Execution
Affected Software:
- Microsoft Word 2002 Service Pack 3
- Microsoft Word 2003 Service Pack 3
- Microsoft Word 2007 Service Pack 2
- Microsoft Word 2010 (32-bit editions)
- Microsoft Word 2010 (64-bit editions)
- Microsoft Office 2004 for Mac
- Microsoft Office 2008 for Mac
- Open XML File Format Converter for Mac
- Microsoft Word Viewer
- Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
- Microsoft Office Web Apps
- Microsoft Word Web App
MS10-080 - Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2293211)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-080.mspx
Impact: Remote Code Execution
Affected Software:
- Microsoft Excel 2002 Service Pack 3
- Microsoft Excel 2003 Service Pack 3
- Microsoft Excel 2007 Service Pack 2
- Microsoft Office 2004 for Mac
- Microsoft Office 2008 for Mac
- Open XML File Format Converter for Mac
- Microsoft Excel Viewer Service Pack 2
- Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
MS10-081 - Vulnerability in Windows Common Control Library Could Allow Remote Code Execution (2296011)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-081.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation not affected)
- Windows Server 2008 R2 for Itanium-based Systems
MS10-082 - Vulnerability in Windows Media Player Could Allow Remote Code Execution (2378111)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-082.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation not affected)
MS10-083 - Vulnerability in COM Validation in Windows Shell and WordPad Could Allow Remote Code Execution (2405882)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-083.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation not affected)
- Windows Server 2008 R2 for Itanium-based Systems
MS10-084 - Vulnerability in Windows Local Procedure Call Could Cause Elevation of Privilege (2360937)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-084.mspx
Impact: Elevation of Privilege
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
MS10-085 - Vulnerability in SChannel Could Allow Denial of Service (2207566)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-085.mspx
Impact: Denial of Service
Affected Software:
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation affected)
- Windows Server 2008 R2 for Itanium-based Systems
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงระดับกลาง (Moderate)
แพตซ์สำหรับแก้ปัญหาความปลอดภัยที่มีความร้ายแรงระดับกลางมีจำนวน 2 ตัว ทั้งหมดเป็นแพตซ์สำหรับแก้ช่องโหว่ความปลอดภัยของ Windows มีรายละเอียดดังต่อไปนี้
MS10-074 - Vulnerability in Microsoft Foundation Classes Could Allow Remote Code Execution (2387149)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-074.mspx
Impact: Remote Code Execution
Affected Software:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation not affected)
- Windows Server 2008 R2 for Itanium-based Systems
MS10-086 - Vulnerability in Windows Shared Cluster Disks Could Allow Tampering (2294255)
Update Link: http://www.microsoft.com/technet/security/Bulletin/MS10-086.mspx
Impact: Remote Tampering
Affected Software:
- Windows Server 2008 R2 for x64-based Systems (Windows Server 2008 R2 Server Core installation affected)
- Windows Server 2008 R2 for Itanium-based Systems
การออกอัพเดทและการอัพเดทระบบ
ผู้ที่ใช้วินโดวส์และซอฟต์แวร์เวอร์ชันที่ได้รับผลกระทบสามารถทำการอัปเดทได้จากเว็บไซต์ Microsoft Update ผ่านทางอินเทอร์เน็ต หรือทำการอัพเดทผ่านทางเซิร์ฟเวอร์ WSUS สำหรับผู้ใช้แบบองค์กรที่มีการติดตั้งระบบ Windows Server Update Services ได้ตั้งแต่วันที่ 13 ตุลาคม 2553 เป็นต้นไป
ความเห็นของผู้เขียน
ถึงแม้ว่าจะเป็นงานหนักของแอดมินติดกันเป็นเดือนที่สาม แต่เนื่องจากมีแพตซ์ 4 ตัวที่แก้ไขช่องโหว่ความปลอดภัยที่มีความร้ายแรงระดับวิกฤติ ดังนั้นเพื่อความปลอดภัยขอให้ท่านที่เป็นแอดมินทั้งหลายทำการอัปเดทแพตซ์ให้เรียบร้อยนะครับ
บทความโดย: Thai Windows Administrator Blog
แหล่งข้อมูลอ้างอิง
• Microsoft Security Bulletin Summary for October 2010
• Technet Blog
ลิงค์ที่เกี่ยวข้อง
• Microsoft Security Center
Copyright © 2010 TWA Blog. All Rights Reserved.
0 Comment:
Post a Comment