Microsoft May 2011 Security Bulletin Release

Microsoft released two (2) security bulletins, one (1) rated Critical and other is rated Important.  Both bulletins relate to remote code execution.

Below is the description of the bulletins, as described in the MSRC Blog:

"MS11-035 (WINS or Windows Internet Name Server): This security update resolves a privately reported vulnerability in the Windows Internet Name Service (WINS). The vulnerability could allow remote code execution if a user received specially crafted malware on an affected system running the WINS service. By default, WINS is not installed on any affected operating system. Only customers who manually install this component are affected by this issue and will be offered the update.

MS11-036 (PowerPoint): This security update resolves two privately reported vulnerabilities in Microsoft PowerPoint. The vulnerabilities could allow remote code execution if a user opens a specially crafted malicious PowerPoint file. An attacker who successfully exploited either of these vulnerabilities could gain the same user rights as a logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. "

Support

The following additional information is provided in the Security Bulletin:

• The affected software listed have been tested to determine which versions are affected. Other versions are past their support life cycle. To determine the support life cycle for your software version, visit Microsoft Support Lifecycle.
  
• Customers in the U.S. and Canada can receive technical support from Security Support or 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. For more information about available support options, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit International Help and Support.

References

• MSRC: May 2011 Security Bulletin Release
• TechNet: Microsoft Security Bulletin Summary for May 2011

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Surprisingly Little Information on Lavasoft Acquisition

It certainly appears as though the acquisition of Lavasoft AB by Lulu Software is being buried under a rug.  Although I first learned about the acquisition over a month ago, it actually occurred in January.

According to the announcement by Mannheimer Swartling, Solaria Fund acquires software business from Lavasoft:

"Solaria Fund acquires software business from Lavasoft (2011-01-18)

Solaria Fund has acquired the anti-spyware and antivirus software business from Lavasoft.

Lavasoft AB, a privately-held company headquartered in Gothenburg, Sweden, is one of the leading actors in the anti-spyware and antivirus segment.

Solaria Fund was advised by Mannheimer Swartling in the acquisition. The firm’s team was led by Johan Ljungberg, primarily assisted by Emma Olnäs Fors and Teresia Mårdh."

Adding to the confusion is the notice buried at the end of the BusinessWeek description of Lavasoft is the additional information:

"As of January 18, 2011, Lavasoft AB operates as a subsidiary of Lulu Software."

Similarly, the BusinessWeek entry for Lulu Software merely indicates "Merger/Acquisition, Lavasoft AB, January 18, 2011".

From what I can ascertain, Lulu Software and Solaria Fund are, if not one and the same, are closely held, with ties to Upclick.com.

• Eric Gareau, CEO at Lulu Software (located in Montreal, Canada)
• Michael Dadoun, Principal at Solaria Fund (located in Montreal, Canada) and Co-Founder at Upclick.com (also Montreal, Canada)
• Calin Udrea, Marketing Director at Lavasoft, formerly Director of Marketing at UpClick

What is most interesting in this change is that there has not been a Lavasoft Press Release.  In fact, it has been rather quiet in Lava-Land with only one press report to date in 2011 and only a half-dozen blog posts to date in 2011. 

Could the silence be related to the less than stellar Web of Trust ratings of Lulu Software's Fixio PC Cleaner Software?

• WOT Lulu Software Scorecard: lulusoftware.com
• WOT Fixio PC Cleaner Scorecard: fixio-pc-cleaner.en.softonic.com

Since it has been well over six years since I used Ad-Aware, perhaps others have also switched to a different anti-malware software program.  Even the Support Forum is woefully quiet, with the current online list showing 0 members logged on to the Forums. 

Baseless speculation aside, the question remains:  Why all the silence about the acquisition?

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Exploitability Index Changes and May Security Bulletin Advance Notice

A welcome change after the huge update in April, on Tuesday, May 10, Microsoft is scheduled to release two security bulletins.  The first addresses a critical vulnerability in Windows.  The second, identified as Important, addresses two vulnerabilities in Microsoft Office.  Both bulletins relate to remote code execution.

As explained in Exploitability Index Improvements Now Offer Additional Guidance:

"As of this month, we will split out the Exploitability Index into a rating for the most recent version of the software, and an aggregate rating for all older versions. In the scenario above, the rating for Windows 7 could be “2" whereas the rating for all other platforms would be "1”. This more accurately reflects risk to customers that keep their environment updated with the latest product releases."

An additional feature to the Exploitability Index will be an assessment of the Denial of Service risk.  Complete details are available in the above-referenced article.


References:

• MSRC: Exploitability Index Improvements & Advance Notification Service for May 2011 Bulletin Release
• TechNet: Microsoft Security Bulletin Advance Notification for May 2011

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...