Clarification on Security Advisory 2896666 and the ANS for the November 2013 Security Bulletin Release

Today, we’re providing advance notification for the release of eight bulletins, three Critical and five Important, for November 2013. The Critical updates address vulnerabilities in Internet Explorer and Microsoft Windows, and the Important updates address issues in Windows and Office.

While this release won’t include an update for the issue first described in Security Advisory 2896666, we’d like to tell you a bit more about it. We’re working to develop a security update and we’ll release it when ready. In the meantime, the advisory includes a Fix it which prevents the attacks from succeeding and we recommend customers apply it to help protect their systems. We also want to provide clarification on the products that the advisory notes are affected. We’ve seen some confusion due to the shared nature of the GDI+ component, which is where the issue resides. There are three ways you can have the GDI+ component installed on your system: Office, Windows, and Lync.

For Office:

• Office 2003 and Office 2007 are affected regardless of the installed operating system. Currently, we are only aware of targeted attacks against Office 2007 users.
• Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems.
• Office 2013 is not affected, regardless of OS platform.

For Windows:

• Supported versions of Windows Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack.
• Other versions of Windows are not directly impacted. Customers who use these systems are only impacted if they have an affected version of Office or Lync.

For Lync clients:

• All supported versions of Lync client are affected but are not known to be under active attack.

Again, we’re only aware of targeted attacks against Office 2007. In those attacks, Windows XP was the operating system seen in use.

As always, we’ve scheduled the security bulletin release for the second Tuesday of the month, November 12, 2013, at approximately 10:00 a.m. PST. Revisit this blog at that time for analysis of the risk and impact, as well as deployment guidance, together with a brief video overview of this month’s updates. Until then, please review the ANS summary page for more information that will help customers prepare for security bulletin testing and deployment.

Don’t forget, you can also follow the MSRC team’s recent activity on Twitter at @MSFTSecResponse.

Thank you,

Dustin Childs
Group Manager, Response Communications
Microsoft Trustworthy Computing