Microsoft Security Bulletin for June 2010 Is A Doozy

Hope you weren't planning to take any time off for the next couple of weeks if you're a Windows admin, because Microsoft released their June 2010 patches today, and brother, you've got some work to do.

Ten bulletins addressing 34 separate vulnerabilities make up this month's offering. Products affected include Windows, Office, SharePoint, Internet Explorer, IIS, and the .NET framework. You know - just about everything outside of databases.

Three fixes in particular are worthy of your immediate attention. MS10-033 affects Windows and could allow remote code execution, so prioritize testing and deployment in your environment. MS10-034 is an update for ActiveX Kill Bits and Redmond deems it critical for Windows 2000, XP, Vista, and Windows 7. MS10-035 is a cumulative update for Internet Explorer that addresses six issues, only one of which was publicly known prior to release of the bulletin according to Microsoft.

SANS has a nice breakdown of the patches, associated CVEs, known exploits, and their recommendations for patching prioritization.

The Microsoft Security Response Center blog has Redmond's latest information about this month's bulletin.

As always, test these hotfixes in a dev environment to see if anything breaks before you deploy them into production, and make sure your antivirus and IDS signatures are up to date. It's typical to see the bad guys reverse-engineer certain patches seeking the root vulnerability that they can then exploit before patching can commence.

Home users should ensure that automatic updates are turned on and that your antivirus software is at the latest version with the most updated virus definitions.

Enjoy.