Microsoft to issue 8 updates, 3 critical, on Patch Tuesday

Summary: All supported versions of Microsoft Windows, Office and Internet Explorer are affected by at least one of the eight bulletins. Microsoft also clarified the impact of this week's disclosure of another vulnerability in Windows, Office and Lync.

This coming Tuesday, November 12, Microsoft will release eight updates for Microsoft Windows, Office and Internet Explorer to patch an as-yet unspecified number of vulnerabilities in them. Three of the updates, affecting Windows and Internet Explorer, are rated critical.

All supported versions of Windows, including the recently-released 8.1, are affected by at least one critical vulnerability. The one bulletin that affects Internet Explorer fixed a critical vulnerability in all versions of the browser, includng the brand new Internet Explorer 11. Three other Windows bulletins are rated Important.

Two other bulletins, both rated important, affect all supported versions of Microsoft Office.

Microsoft will also release their other usual monthly updates, including a new version of the Malicious Software Removal Tool and a large number of non-security updates.

Earlier this week Microsoft disclosed a vulnerability affecting some versions of Windows and Office and all versions of Microsoft Lync. The vulnerability is being used in zero-day attacks specifically against Office. The Patch Tuesday updates this month will not address this vulnerability.

Today Microsoft issued a clarification of the bulletin for that vulnerability. The main point of the clarification is that only some Office users are being attacked, not users of the other products who are not running an affected version of Office. The confusing nature of the product matrix comes from the confusing way in which GDI+, the affected component, is bundled with different products. If you are concerned about the vulnerability see the Microsoft bulletin for instructions on how to work around it until an update is ready from Microsoft.

Topics: Security, Microsoft, Windows

Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Wish you could predict the future? Today's data analytics is about as close as you can get to real magic. This live, interactive webcast will focus on how data analytics can help you anticipate activity to meet your ever-changing supply chain requirements. Register now!

Air Canada wanted something to make things a little easier for their customers, and using technology from IBM was able to offer self service. Check out this white paper to hear more about how IBM is making the airlines smarter.

Don't let any important alerts be missed! SolarWinds Alert Central gives you a centralized place to receive and send alerts for ALL your IT monitoring systems. Download it today!

HTC and Motorola announce Android 4.4 KitKat updates for existing devices

Summary: Google revealed Android 4.4 KitKat details yesterday, along with the Nexus 5. HTC and Motorola were quick to inform consumers they will be providing updates for their smartphones very soon.

(Image: Google)

One of the frustrations with Android is the lack of updates for existing devices when a new OS update is announced. It looks like HTC and Motorola are working to eliminate that frustration with announcements that their latest products will be updated soon.

As a major fan of the HTC One, I was particularly pleased to hear that Jason Mackenzie, president of HTC America, confirmed the One would get the update within 15 to 90 days.

The Google Play Edition should see Android 4.4 within 15 days, the unlocked model and Developer Edition within 30 days, and the carrier variants within 90 days.

The fact that the One will indeed be getting the 4.4 update, just after the 4.3 update, means my One will not be going anywhere even if I end up keeping the Nexus 5 I just ordered.

Motorola also revealed that the Moto X, Droid Ultra, Droid Maxx, and Droid Mini will all be getting Android 4.4. There was no time frame reported for these updates.

Many older devices, including the Galaxy Nexus, will not be upgraded to Android 4.4. It is difficult for Google and manufacturers to upgrade these older devices when internals are outdated while it is much easier for Apple to provide updates when they control the entire hardware and software environment.

Further reading

Topics: Mobility, Android, Google, HTC, Smartphones

Matthew Miller started using a Pilot 1000 in 1997 and has been writing news, reviews, and opinion pieces ever since.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Give yourself a unified view of your global IT systems' performance, availability and capacity across all server platforms, network devices, applications and IT business services with up.time. Try up.time now. (Available in the US, Canada, UK, and Australia only.)

In this new white paper, see how to proactively achieve compliance, and discover a valuable checklist for getting started. Read it today!

Wish you could predict the future? Today's data analytics is about as close as you can get to real magic. This live, interactive webcast will focus on how data analytics can help you anticipate activity to meet your ever-changing supply chain requirements. Register now!

Fake Chrome, Adobe Flash updates

Summary: Be alert to false updates of chrome and Adobe Flash using techniques of high quality.

This morning I stumbled across what seems to be a new technique of propagation of malware: false updates to Google Chrome and false update "media player" which is designed to look like it comes from Adobe.

Both versions are digitally signed by a valid VeriSign code signing certificates. This is not unprecedented, but it is very unusual for malware authors to use an expensive provider such as VeriSign. VeriSign authentication services are now part of Symantec.

The fake Chrome update uses a similar logo of Chrome, but obviously distinguishable from it. The page correctly identifies the version of Chrome led (the current version) and then says that "it can be dated".

The file is called Chrome_Security_Plugin_Setup.exe and is 1.74 MB. The information in the file identifies it as "Express Install" versión "3, 7, 1, 0". The editor, also identified in the VeriSign code signing certificate, it is "Small Installer".

According to VirusTotal Friday morning, five of the 48 products work with recognized the file. Fortinet and ESET recognized as W32/Kryptik. A blog entry of Fortinet since early this year described as a different from Kryptik variant be focused by FTP information theft and complimented the author on the high quality of your code.

The fake Adobe update is a little less clear about which product is imitating. Instructs the user "update your Media Player now [mandatory]" and uses the appearance of an Adobe update.

The file name is "12.exe Flash Player" and 814 KB. The editor in the PE header, and code signing certificate VeriSign is identified as "Software of air" and PE product name is "Adobe Flash Player" versión 2.0.4.54. VirusTotal is 9 of 48 companies that often identify themselves as adware.

I discovered the files by accident. Through a typo in the address bar I went to an address from which the browser was redirected a few times until it ended in a page that loads one of the two attacks described above. I have notified the administrative contact for the domain, which seems to have been parked.

The first time I found the files I have to pages without any problem. Shortly after, Google Safe Browsing API blocked access to them in Firefox and Chrome.

Larry Seltzer has been a recognized expert in technology, with emphasis on mobile technology and security in recent years

Microsoft continues to leave more iOS, Android app updates

Summary: Microsoft updates their version for Android app Outlook.com, as well as its Lync clients for iPhone and iPad this week.

While many consider long rumored (and supposedly fall 2014 - limit) Microsoft Office for the iPad to be the best proof that the company actually plans to continue being a multiplatform player, Microsoft continues to deliver updates to a lot of other products and services on non-Windows platforms.

On 10 October, Microsoft released a major update to your Outlook.com for the application for Android. New to the latest version is the new option to download all mail messages; the ability to Outlook.com servers search for older messages; support for aliases; Select colored items; and answers support holiday.

Microsoft also updated its customers mobile Lync this week for the iPhone, iPad and Windows Phone. The latest updates from mobile Lync for these platforms allows users to join and participate in a meeting of Lync even without an account of Lync; start a live chat (IM or video) not programmed Lync from a mobile device; (e) invite or remove participants at a meeting of Lync.

In both cases, these new versions are available in their respective app stores.

Earlier this week, Microsoft also updated their Skype applications for Android and the iOS7.

Mary Jo has covered the technology industry for more than 25 years for a variety of publications and websites and is a frequent guest on radio and TV, podcasts, talking about all things related to Microsoft. She is the author of Microsoft 2.0: how Microsoft plans to stay relevant in the era post Gates (John Wiley & sons, 2008).

Updates on tap for two email marketing service providers

Email marketing continues to be one of the most widely used methods for small-business owners to connect with existing customers, and with prospects. Research from the Radicati Group pegs revenue for this market at approximately $12 billion, and it's expected to surpass $16 billion by 2016.

One of the best-known companies among these service providers, Constant Contact, this week made two significant changes to its platform.

The first big update centers on contact management: essentially, Constant Contact is embedding a much richer set of reporting features into its native contact manager so that small businesses can more closely track relevant interaction information in context.

For example, you can see click-throughs, newsletter opens or event attendance figures within the contact. There's even a new "did not open" reporting capabilities. (Yes, the service is starting to look and sound sort of like a customer relationship management application.)

The other big change is focused on the MyLibrary component of Constant Contact, which is the place where subscribers store images and documents.

This feature now supports Microsoft Word, PowerPoint and Excel document uploads (in addition to PDFs and images). What's more, you can drag and drop images directly from a computer desktop or from within Facebook or Instagram profiles.

There's also a new version of the Quickview mobile app for interacting with MyLibrary; it runs on both Android and Apple iOS. Despite its name, this isn't just a viewer": you can upload documents, edit files names, copy file URLS and so on.

The entry-level version of Constant Contact's email service starts at $15 per month for up to 500 contacts. The company, based in Waltham, Mass., has been around since 1998. It counts more than 500,000 small-business customers.

Constant Contact isn't the only game in town, of course. As I was reading up on these updates, I was pinged by Montreal-based CakeMail, which also offers a service for managing email marketing campaigns. Its offering, called CakeMail 4 is a far slimmer service, with a focus on simplicity and ease of use: it allows contact management and personalized campaigns that can be generated using templates. The service starts at $8 per month, although you can use a sponsored version (you'll have to put up with ads) for free if you have fewer than 2,000 contacts.

CakeMail's private label version is used by more than 350 brands in 40 countries. The Montreal-based company was launched in 2007. 

Related stories:

HP updates business laptop line with new EliteBook, ProBook laptops

Summary: Between the large number of new laptops are a pair of Ultrabooks.

 

Just a couple of weeks after announcing its first mobile workstation Ultrabook, the 14 ZBook, HP is more to renew its line of laptop business, introducing a series of new notebooks today with more style and more security, according to the company.

For more budget companies, 400 ProBook series starts at just $499. That model, the G1 455 ProBook has AMD processor options and a 15.6-inch screen. Other models, such as the 440 of 14 inches (from $559) and 13.3-inch (from $649) 430 are equipped with Haswell Intel processors instead. The 455 G1 features a touchscreen option, as well as an optional hybrid hard drive. These portable main are available today on the HP website.

The alignment of 600 ProBook will begin in November as a step above the 400 series, with options like full 1080 p HD screens and 4 G LTE support shipping. You can choose between several AMD and Intel processors and HP aims to the ProBook G1 655 19 percent slimmer than the previous generation models. The Iran price from $699 per the 640, 645, 650 and 655.

800 EliteBook series adds a couple of Ultrabooks to list of HP business. The 14-inch EliteBook 840 G1 is certified Ultrabook early on, while the 15.6-inch 850 G1 will offer a setting that qualifies as a Ultrabook. Ironically, the 800 smallest elitebook - the 820 12 inch G1, which weighs less than 3 pounds - is not a Ultrabook.

These EliteBooks are starting at $799, thanks in part to the magnesium chassis that meets the military standard MIL-SPEC - 810G of roughness and secure hardware-based technology Start of HP, which works to block BIOS attack automatically. If the BIOS has been attacked or corrupted, recovery mode start safe Crisis replaces impacted BIOS. G1 840 EliteBook can also equip a slice of optional battery that increases the duration of the battery 33 hours, according to HP.

While HP is clearly trying to refresh the corporate notebook seriously with these new offerings, not all are convinced that enterprise, which not long ago was willing to abandon the production of parts altogether, has found a recipe for renewed success. For more information about the strategy from HP, check out a summary of my colleague Zack Whittaker in his recent meeting with the executives of the company.

Topics: Laptops, Hewlett-Packard, mobility

Sean Portnoy is a former executive editor at Computer Shopper magazine and editor of CNET Networks.

Start your day with a daily newsletter of ZDNet. It is the freshest technology news and opinion, served hot. Get it.

EMC VNX family provides automated, cost-effective unified storage. Watch this white paper for the top five simple advantages of EMC VNX.

Remote support DameWare (DRS) helps you to manage remotely the Windows ® desktops and laptops in his universe is. Download a free 14 day trial of DameWare remote support today!

Gives you a unified view of performance, availability and capacity of its global IT systems across all platforms, server, network devices, applications and services of business IT with up.time. Try up.time. (Available in the United States, Canada, UK and Australia only).