Dial In Number Pin: 3959 Information About Microsoft September 21, 2012 Security Bulletin Jeremy Tinder Security Program Manager Microsoft Corporation Dustin Childs Group Manager, Response Communications Microsoft Corporation

Dial In Number Pin: 3959 Live Video Stream To receive our video stream in LiveMeeting:To receive our video stream in LiveMeeting: –Click on Voice & Video –Click the drop down next to the camera icon –Select Show Main Video

Dial In Number Pin: 3959 What We Will Cover Review of September 21, 2012 Bulletin Out-of-Band release information for Security Bulletin MS12-063Review of September 21, 2012 Bulletin Out-of-Band release information for Security Bulletin MS Security Advisory Security Advisory ResourcesResources Questions and Answers: Please Submit NowQuestions and Answers: Please Submit Now –Submit Questions via Twitter #MSFTSecWebcast

Dial In Number Pin: 3959 Severity and Exploitability Index Exploitability Index 1 RISK 2 3 DP1 Severity Critical IMPACT Important Moderate Low MS Internet Explorer

Dial In Number Pin: 3959 Bulletin Deployment Priority

Dial In Number Pin: 3959 MS12-063: Cumulative Update for Internet Explorer ( ) CVESeverity Exploitability CommentNote Latest Software Older Versions CVE CriticalNA1 Remote Code Execution Cooperatively Disclosed CVE CriticalNA1 Remote Code Execution Cooperatively Disclosed CVE CriticalNA2 Remote Code Execution Cooperatively Disclosed CVE CriticalN/A1 Remote Code Execution Cooperatively Disclosed CVE CriticalNA1 Remote Code Execution Publicly Disclosed Affected Products Internet Explorer 6,7,8, & 9 on Windows Clients (except Windows 8) Internet Explorer 6,7,8, & 9 on Windows Servers (except Windows Server 2012) Affected Components IE6, IE7, IE8, and IE9 on Windows clients and Servers Deployment Priority Critical Main Target Workstations and servers running Internet Explorer. Possible Attack Vectors An attacker could host a website that contains a page crafted to exploit this vulnerability.An attacker could host a website that contains a page crafted to exploit this vulnerability. The attacker could also take advantage of compromised websites and websites that accept or host user- provided content or advertisements. Impact of Attack An attacker who successfully exploited these vulnerabilities could obtain the same permissions as the currently logged-on user.An attacker who successfully exploited these vulnerabilities could obtain the same permissions as the currently logged-on user. Mitigating Factors An attacker would have no way to force users to visit a malicious website.An attacker would have no way to force users to visit a malicious website. By default, Internet Explorer on Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode known as Enhanced Security Configuration.By default, Internet Explorer on Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 runs in a restricted mode known as Enhanced Security Configuration. By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML s in the Restricted sites zone.By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML s in the Restricted sites zone. Additional Information This bulletin addresses five critical-class issues including CVE , which deprecates Security Advisory This bulletin addresses five critical-class issues including CVE , which deprecates Security Advisory Installations using Server Core are not affected.Installations using Server Core are not affected.

Dial In Number Pin: 3959 Microsoft Security Advisory : Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 An advisory released on September 21, 2012 addresses vulnerabilities in Adobe Flash Player in Internet Explorer 10 on Windows 8. – –Addresses issues in Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012 – –The majority of customers have automatic updates enabled and will not need to take any action. – –Customers who do not use automatic updates should apply the guidance in the advisory immediately

Dial In Number Pin: 3959 Detection & Deployment

Dial In Number Pin: 3959 Other Update Information

Dial In Number Pin: 3959 Resources Blogs Microsoft Security Response Center (MSRC) blog: Security Response Center (MSRC) blog: Security Research & Defense blog: Research & Defense blog: Microsoft Malware Protection Center Blog: Malware Protection Center Blog: Twitter Security Centers Microsoft Security Home Page: Security Home Page: TechNet Security Center: Security Center: MSDN Security Developer Center: us/security/default.aspxMSDN Security Developer Center: us/security/default.aspx us/security/default.aspx us/security/default.aspx Bulletins, Advisories, Notifications & Newsletters Security Bulletins Summary: ary.mspxSecurity Bulletins Summary: ary.mspx ary.mspx ary.mspx Security Bulletins Search: Bulletins Search: Security Advisories: Advisories: Microsoft Technical Security Notifications: mspxMicrosoft Technical Security Notifications: mspx mspx mspx Microsoft Security Newsletter: Security Newsletter: Other Resources Update Management Process e/patchmanagement/secmod193.mspxUpdate Management Process e/patchmanagement/secmod193.mspx e/patchmanagement/secmod193.mspx e/patchmanagement/secmod193.mspx Microsoft Active Protection Program Partners: ners.mspxMicrosoft Active Protection Program Partners: ners.mspx ners.mspx ners.mspx

Dial In Number Pin: 3959 Questions and Answers Submit text questions using the Ask button.Submit text questions using the Ask button. Dont forget to fill out the survey.Dont forget to fill out the survey. A recording of this webcast will be available within 48 hours on the MSRC Blog: recording of this webcast will be available within 48 hours on the MSRC Blog: Register for next months webcast at: for next months webcast at:

Dial In Number Pin: 3959