Included in the most recent Patch Tuesday, were patches for two vulnerabilities previously made public: one in Server Message Block Version 2 (SMBv2) and the other in Internet Information Services.

Security company Symantec has shared its views on this Patch Tuesday, which are quite positive. "We’re pleased that Microsoft released a patch for the SMBv2 vulnerability," said Ben Greenbaum, senior research manager, Symantec Security Response. "The vulnerability was made public last month. We’ve yet to see a highly reliable exploit for it. Although we have seen limited attempts to exploit this vulnerability, we’re glad to see this fixed before widespread attacks occur."
 
In addition, Microsoft also released the first security update for the release-to-manufacturing version of Windows 7. "The update that addresses vulnerabilities in Windows 7 relates to the Active Template Library issues Microsoft has been working on for a number of months now," said Greenbaum. "It essentially disables additional faulty ActiveX controls created using the library that have been distributed across Windows users’ machines."

Symantec says the vulnerabilities addressed in Internet Explorer and the GDI+ graphics library (what Windows uses to determine how to interact with certain graphics files that users encounter during everyday computer use) are serious too.

"The primary danger the GDI+ graphics library and Internet Explorer vulnerabilities pose is that these vulnerable components are present on the majority of Windows machines," said Greenbaum. "Many of the issues addressed today are fairly trivial to exploit. For example, via a drive-by-download style attack. In that case, all a computer user would have to do to become infected by an attack using one of these vulnerabilities is unsuspectingly visit a compromised Web site."

Needless to say, Symantec is strongly encouraging users to take advantage of these latest patches from Microsoft. They are also encouraging people in general, to regularly install vendor patches as soon as they are available, consider implementing an automated patch management solution, run all software with the least privileges required while maintaining functionality, and other basic security best practices.

Only four July security bulletins emerged from Microsoft during their monthly patch cycle, affectionately known as Patch Tuesday. All of the bulletins received a rating of Important, meaning Windows users were spared from the threat of more dangerous Critical issues for this month, anyway.

Some have demonstrated in the past how fast an exploit for a revealed flaw might come into being. The development cycle for malware aimed at newly-disclosed flaws tightened considerably over the past few years.

Being slow to update a system, or even forgoing such security updates, left those systems exposed to exploits created to affect flaws. Automatic updates, when enables, brings in patches much faster.

This time around, Microsoft corrected a pair of privately-disclosed vulnerabilities in Outlook Web Access, both of which posed privilege elevation threats. A person with significant rights on their Windows machine hit by an attacker, who could then elevate his privileges to match the user’s, could experience a lot of problems from a malicious party.

Microsoft also provided fixes for Windows Explorer, SQL Server, and the Windows Domain Name System. Though rated Important, the Windows Explorer issue started with a publicly disclosed vulnerability.

That problem posed a remote code execution threat, though not one as serious as others that have been corrected in the past. DNS required a fix to stop potential spoofing, a dangerous condition where an attacker redirects web traffic while the user thinks he is visiting a legitimate site.

SQL Server saw a quartet of issues resolved. The worst of those would have enabled a certain attack to allow for complete control of a targeted system, if successful.