IE9, IE10의 공개된 보안 취약점에 대한 마이크로소프트 보안 공지 2934088 발표

February 19, 2014, 5:39 pm

≫ Next: How to export the AD FS token-signing certificate with PowerShell

≪ Previous: Top Support Solutions for Microsoft SQL Server 2012

Microsoft 는 2014년 2월 20일(한국시각)에 Internet Explorer 9 와 Internet Explorer 10 의 공개된 취약점에 대한 보안 Microsoft 보안 권고 2934088을 발표합니다.

Microsoft 보안 권고 2934088 Internet Explorer의 취약점으로 인한 원격 코드 실행 문제점
http://technet.microsoft.com/security/advisory/2934088

==================================
요약
==================================
Microsoft 는 Internet Explorer 10 의 공개된 취약점을 악용하여 제한적이며 대상이 일정한 실제 공격에 대한 보고를 받았습니다. 이번 취약점은 Internet Explorer 9과 Internet Explorer 10에만 영향을 받으며, 지원 중인 다른 버전의 Internet Explorer 는 영향을 받지 않습니다. Microsoft Fix it 자동화 솔루션,"MSHTML Shim Workaround"를 적용하면 이 문제의 취약점을 방지할 수 있습니다. 자세한 내용은 보안 권고의 권장 조치 항목을 살펴보시기 바랍니다.

이 취약점은 원격 코드 실행 취약점으로 Internet Explorer 가 삭제되었거나 적절하게 할당되지는 않은 메모리의 개체에 액세스하는 방식에 취약점이 존재합니다.

취약점으로 인해 공격자가 Internet Explorer 내 현재 사용자의 컨텍스트에서 임의의 코드를 실행할 수 있는 방식을 통해 메모리가 손상될 수 있습니다. 공격자는 Internet Explorer를 통해 이 취약점을 악용하도록 설계하여 특수하게 조작된 웹 사이트를 호스팅 한 다음 사용자가 이 웹 사이트를 보도록 유도할 수 있습니다.

조사가 완료되는 대로, Microsoft는 고객을 보호하기 위한 적절한 조치를 취할 것입니다. 여기에는 월별 보안 업데이트 또는 부정기 보안 업데이트를 통한 해결 방법이 포함될 수 있으며, 고객의 요구에 따라 달라질 수 있습니다.

Microsoft 는 고객에게 폭넓은 보호를 제공할 수 있도록 정보를 제공하기 위해 Microsoft Active Protections Program(MAPP) 프로그램 파트너와 협력하고 있습니다. 또한 마이크로소프트는 위협 현황을 모니터링하고 이 취약점을 악용하려는 악성 사이트에 대한 조치를 취하기 위해 파트너와 협력하고 있습니다.

==================================
완화 요소
==================================
• 기본적으로 Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 및 Windows Server 2012 R2 의 Internet Explorer는 보안 강화 구성으로 알려진 제한된 모드로 실행됩니다. 이 모드에서는 이 취약점이 완화됩니다.

• 기본적으로 지원 대상인 모든 Microsoft Outlook, Microsoft Outlook Express 및 Windows Mail 버전은 제한된 사이트 영역에서 HTML 메일 메시지를 엽니다. 스크립트 및 ActiveX 컨트롤을 비활성화하는 제한된 사이트 영역은 공격자가 이 취약점을 악용하여 악성 코드를 실행하는 위험을 줄이는 데 도움이 됩니다. 사용자가 메일에 포함된 링크를 클릭하면 웹 기반 공격 시나리오를 통해 이 취약점 악용에 취약해질 수 있습니다.

• 취약점 악용에 성공한 공격자는 현재 사용자와 동일한 권한을 얻을 수 있습니다. 시스템에 대한 사용자 권한이 적게 구성된 계정의 사용자는 관리자 권한으로 작업하는 사용자에 비해 영향을 적게 받습니다.

• 웹을 통한 공격의 경우 공격자는 호스팅하는 웹 사이트에 이 취약점을 악용하는 웹 페이지를 포함할 수 있습니다. 또한 사용자가 제공한 콘텐츠나 광고를 허용하거나 호스팅하는 공격 당한 웹 사이트에는 이 취약점을 악용할 수 있는 특수하게 조작된 콘텐츠가 포함되어 있을 수 있습니다. 그러나 어떠한 경우에도 공격자는 강제로 사용자가 이러한 웹 사이트를 방문하도록 만들 수 없습니다. 대신 공격자는 사용자가 전자 메일 메시지 또는 인스턴트 메신저 메시지의 링크를 클릭하여 공격자의 웹 사이트를 방문하도록 유도하는 것이 일반적입니다.

==================================
권고 사항
==================================
문제에 대한 설명과 영향을 받는 구성요소, 완화 요소, 조치 사항, FAQ 및 관련 정보에 대한 상세 정보 등은 Microsoft 보안 권고 문서 2937088 을 살펴보시기 바랍니다.

영향을 받았다고 생각되는 고객은 고객 지원 서비스에 문의할 수 있습니다. 고객 지원 서비스에 대한 정보는 http://www.microsoft.com/ko-kr/security/default.aspx를 참고하십시오.

==================================
추가 정보
==================================
• Microsoft 보안 권고 2934088 Internet Explorer의 취약점으로 인한 원격 코드 실행 문제점 - http://technet.microsoft.com/security/advisory/2934088

• Microsoft Security Response Center (MSRC) Blog: http://blogs.technet.com/msrc

• Security Research & Defense (SRD) Blog: http://blogs.technet.com/srd

• Microsoft Malware Protection Center (MMPC) Blog: http://blogs.technet.com/mmpc

==================================
정보의 일관성
==================================
본 메일과 웹 페이지를 통하여 가급적 정확한 내용을 제공하기 위하여 노력하고 있습니다. 웹에 게시된 보안 공지는 최신의 정보를 반영하기 위해 수정되는 경우가 있습니다. 이러한 이유로 본 메일의 정보와 웹 기반의 보안 공지 간에 내용이 불 일치하는 일이 생긴다면, 웹에 게시된 보안 공지의 정보가 더 신뢰할 수 있는 정보입니다.
기술 지원은 지역번호 없이 전화 1577-9700을 통해 한국마이크로소프트 고객지원센터에서 받을 수 있습니다.
보안 업데이트와 관련된 기술 지원 통화는 무료입니다.

감사합니다.
한국마이크로소프트 고객지원부

↧

How to export the AD FS token-signing certificate with PowerShell

February 19, 2014, 7:17 pm

≫ Next: New Hybrid Cloud Services Planning and Design Guide in the Windows Server Technical Library

≪ Previous: IE9, IE10의 공개된 보안 취약점에 대한 마이크로소프트 보안 공지 2934088 발표

How to export

...(read more)

↧

New Hybrid Cloud Services Planning and Design Guide in the Windows Server Technical Library

February 20, 2014, 11:37 am

≫ Next: Hierarchical Address Book now available in Office 365 too

≪ Previous: How to export the AD FS token-signing certificate with PowerShell

If you're interested in deploying the Hybrid Cloud Multi-Tenant Network solution, you can use this new guide to design and plan your implementation:

Connect hosting provider and tenant networks for hybrid cloud services: plan and design guide

Using the guide, you can plan your hybrid cloud deployment using System Center 2012 R2 Virtual Machine Manager (VMM), Windows Server Gateway, and Hyper-V Network Virtualization in Windows Server 2012 R2. This guide describes the hardware and software that you’ll need for the solution, as well as the design and planning decisions for implementing it.

↧

Hierarchical Address Book now available in Office 365 too

February 20, 2014, 11:42 am

≫ Next: By Margo Day, Vice President, U.S. Education: New Apps Take Learning to a Personal Level

≪ Previous: New Hybrid Cloud Services Planning and Design Guide in the Windows Server Technical Library

Exchange 2013 debuted last year with the ability to configure a Hierarchical Address Book (HAB) for on premises deployments.

As many of our customers are migrating and evaluating the cloud, a consistent user experience between online and on premises deployments is not just a requirement, but an expectation. As such, we are really excited to announce the availability of HAB to Office 365 users, worldwide!

Now, a tenant administrator for Office 365 is able to configure a HAB using the same commands one would in an on premises deployment.

For more information on how to configure and use a HAB, please refer to HierarchicalAddressBooks: Exchange 2013 Help‎.

FAQ

We are moving some of our user mailboxes to Office 365 while keeping some in our on premises infrastructure. Are the users able to see the same HAB?

No, we are working to resolve a possible issue of the HAB being out of sync in this hybrid deployment case. A solution will be available in the near future.

Can Outlook Web App (OWA) users use the HAB?

No, browsing the HAB is available for Outlook 2010/2013 only at this time.

Paul Lo

↧

By Margo Day, Vice President, U.S. Education: New Apps Take Learning to a Personal Level

February 20, 2014, 11:43 am

≫ Next: To Lync Conference 2014: Thank you!

≪ Previous: Hierarchical Address Book now available in Office 365 too

We’re in the midst of an exciting transformation in education, fueled by technology. Today, Pearson took us one step closer to achieving personalized digital learning for all students. Available for use by schools in the 2014-2015 school year, Pearson’s Common Core System of Courses, TestNav, and reading apps iLit and eText will be available on the Windows 8 platform. We know every student is unique and there is no one-size-fits-all technology solution that inspires every student and...(read more)

↧

To Lync Conference 2014: Thank you!

February 20, 2014, 11:43 am

≫ Next: Xbox inviting select Xbox Live members to preview Xbox One updates

≪ Previous: By Margo Day, Vice President, U.S. Education: New Apps Take Learning to a Personal Level

To the folks who couldn't be here, thank you for engaging with us over social, watching the keynote, and connecting with us from afar. Every tweet you sent was shared on a giant 30-foot tall screen in the expo hall. We hope you can join us next time…from a capacity perspective, it's going to be completely different, so no worries. Just please register early, OK?

To our amazing logistics teams, you were the engine of the show. We sold out expo – again, spilled out of our hotel – again, tripled our speakers, doubled onsite bodies, and kept the local authorities satisfied. You are amazing and roll with everything. Thank you.

To our technical teams – we doubled our bandwidth and capacity and tripled our breakout rooms. Whether in keynote or the expo hall, everyone worked their butts off. And everything worked. Thanks so much for the over-engineering.

To our speakers, engineers, proctors, assistants, and booth staff – you are the reason everyone here took a week away from their lives to talk Lync in the desert. Thank you for the phenomenal presentations, labs, white board sessions, and conversations.

To our MVPs – what can we say? Your work for Lync is constant and tireless, virtually and physically. We are so thankful for your efforts spreading the business benefits and technical internals of Lync over the years and consistently holding us accountable.

To our sponsors – your consistent refrain of "more passes" and early announcements was a welcome early sign of great things to come. It completely outmatched our wildest expectations when we walked into the Lync Conference expo hall, stretching far into the distance, filled with the universe that is Lync. It's humbling. Thank you for helping our customers on this journey with us.

And to the customers and users of Lync – we do it all for you. Thanks for learning with us, sharing your stories and growing as a community. You're the best. Tell us how we can do it again, but better – please submit your evals.

Lastly, to all of you and everyone else in the Lync and Skype communities – we appreciate your passion, hard work, and time to help make this conference the best it could be. We look forward to seeing each and every one one of you next year.

Sami Abou Saab - Partner

Jacky Magee - Social

Jennifer Yust - Customers

Tim Woo - Keynote

Jamie Stark - Content

Lauren Husum - Lead

Lync Conference 2014 Team

Skype / Lync Enterprise Product Marketing

Microsoft Corporation

↧

Xbox inviting select Xbox Live members to preview Xbox One updates

February 20, 2014, 11:56 am

≫ Next: Ask fashion designer Victoria Beckham your style questions on Skype

≪ Previous: To Lync Conference 2014: Thank you!

Xbox is inviting select Xbox Live members to preview and provide feedback on new features coming to Xbox One in a March system update, as well as future system updates, before the updates are implemented worldwide, reports Major Nelson.

“Selected participants will receive a message over Xbox Live with a code to register,” he writes on his blog. “The next system update will begin rolling out next week to those who will preview the new features. Once registered, participants will be able to test the early features included in the update and provide feedback on a private forum and can opt out of future waves.”

As Marc Whitten, chief product officer, said recently, updates coming next month will significantly improve the multiplayer and party experiences on Xbox One. “We’re counting on our fans to share their input as we’re putting the final touches on the new features that we plan to deliver in early March,” Major Nelson writes.

To learn more, head over to Major Nelson’s blog or to Xbox Wire.

You might also be interested in:

· New Xbox One Media Remote lets you control your TV, Blu-ray playback, streaming video
· First Xbox One update starting to roll out
· Xbox One multiplayer and party updates coming in March

Suzanne Choney
Microsoft News Center Staff

↧

Ask fashion designer Victoria Beckham your style questions on Skype

February 20, 2014, 11:57 am

≫ Next: PowerTip: Find Status of PowerShell Preference Variables

≪ Previous: Xbox inviting select Xbox Live members to preview Xbox One updates

If you’ve ever wondered what life is like for a top fashion designer, you can find out by asking Victoria Beckham questions via Skype video message, and follow her fashion journey and creative inspiration on The Skype Collaboration Project.

“The aim of the project is to shine a spotlight on the intersection between technology and the creative industries, and to help aspiring creatives get their start in fashion,” writes Jackie Lee-Joe on Skype’s Big Blog.

On The Skype Collaboration Project site, you’ll find “Five Years – The Victoria Beckham Fashion Story,” an immersive view of Beckham and her fashion label. You’ll also get access to exclusive content from the New York and London fashion weeks events.

“I hope by sharing my story, I will inspire others who are interested in fashion and encourage them to work hard and follow their dreams as I did,” Beckham says.

To read Lee-Joe’s post, head over to Skype’s Big Blog.

You might also be interested in:

· “Tap the Frog” from lily pads to outer space on Windows Phone
· Stretch yourself with the first-ever Instagram Yoga Challenge with prizes from Skype
· Never go hunting for your keys and wallet again using Nokia Treasure Tag

Suzanne Choney
Microsoft News Center Staff

↧

PowerTip: Find Status of PowerShell Preference Variables

February 20, 2014, 11:59 am

≫ Next: Next week’s HIMSS conference to showcase how Windows devices and analytics are helping improve health care

≪ Previous: Ask fashion designer Victoria Beckham your style questions on Skype

Summary: Easily find the status of Windows PowerShell Preference variables.

Hey, Scripting Guy! Question How can I see the preference settings that I can change with Windows PowerShell?

Hey, Scripting Guy! Answer Look at variables that contain the word Preference in their name by using the Get-ChildItem
and looking at the Variable drive:

Get-ChildItem variable:*preference

Note To see all of the Windows PowerShell Preference variables, see about_Preference_Variables.
Many of the Preference variables are not present on the Variable drive unless you change their initial values.

↧

Next week’s HIMSS conference to showcase how Windows devices and analytics are helping improve health care

February 20, 2014, 12:27 pm

≫ Next: TechNet Flash February 19, 2014: Don’t miss President Bill Clinton at SharePoint Conference, get into the Windows Performance Toolkit, and learn more about Power BI

≪ Previous: PowerTip: Find Status of PowerShell Preference Variables

At the Healthcare Information and Management Systems Society 2014 annual conference and exhibition (HIMSS), which begins Feb. 23, the global health and technology community comes together to share best practices, as well as everyday tips and tricks.

As Neil Jordan, general manager of Health Worldwide for Microsoft, explains on the Microsoft in Health blog, the industry is moving into a post-electronic medical records world, and with that, organizations are thinking about “the next phase of health IT.”

He reports that “health organizations are taking advantage of today’s enterprise-class devices” and highlights the work of Palmetto Health and New York Presbyterian, which are improving clinician productivity and patient care using Windows tablets. At HIMSS, he says, there will be plenty to peruse in terms of Windows devices, from Microsoft, Nokia, Lenovo, HP and Dell. Attendees will also be able to check out “Windows apps from established names in the health industry such as Cerner, Epic and Allscripts.”

Jordan says another top priority for health organizations is health analytics, “as they look for ways to unlock the value of the vast amount of digital data in the health care system.” Attendees will see “powerful, yet easy-to-use analytics capabilities” from Microsoft partners such as Avanade, Predixion and Epic. Epic’s embedded health care analytics platform, Cogito, will be demonstrated at a Microsoft lunch-and-learn session. Meriter Health Services will also be at HIMSS discussing how they use Power BI for Office 365 to help anticipate and plan for the needs of patients with chronic diseases.

For more information and to register for events, check out the Microsoft @ HIMSS page and read the rest of Jordan’s post on the Microsoft in Health blog.

You might also be interested in:

Athima Chansanchai
Microsoft News Center Staff

↧

TechNet Flash February 19, 2014: Don’t miss President Bill Clinton at SharePoint Conference, get into the Windows Performance Toolkit, and learn more about Power BI

February 20, 2014, 12:42 pm

≫ Next: Find out what it takes to pull off a successful keynote demo at Lync Conference 2014

≪ Previous: Next week’s HIMSS conference to showcase how Windows devices and analytics are helping improve health care

TechNet Flash is a bi-weekly newsletter that delivers the latest alerts of new resources to help IT professionals be more successful with Microsoft products and technologies. Subscribe here . Here are the headlines from February 19, 2014: Top News: President Bill Clinton to keynote SharePoint Conference 2014 Free MVA course: Improving Windows performance and using the Windows Performance Toolkit New blog series: Disaster recovery and business continuity best practices for...(read more)

↧

Find out what it takes to pull off a successful keynote demo at Lync Conference 2014

February 20, 2014, 1:57 pm

≫ Next: Top Support Solutions for Microsoft SQL Server 2008

≪ Previous: TechNet Flash February 19, 2014: Don’t miss President Bill Clinton at SharePoint Conference, get into the Windows Performance Toolkit, and learn more about Power BI

Corporate vice president Derek Burney (left) adjusts KISS dolls to ensure they would be at the perfect height for a variety of cameras.

Now that the Lync Conference 2014 is over, Tim Woo, Lync demo lead can breathe a sigh of relief for a job well done. Through The Lync Team Blog, he revealed what it takes to create and successfully execute a keynote demo.

He shows several pictures on the site, including an empty ballroom at the Aria Conference Center in Las Vegas that a production crew would transform by building a stage, control room and sets in the green room.

“A lot of moving parts go into a keynote demo and it’s always amazing to watch all the pieces come together on show day,” Woo says. He laid out his “recipe for success”: a captivating speaker in Microsoft corporate vice president Derek Burney, a team of highly-skilled engineers to make sure there are no glitches in the live code, demo assistants from the Lync marketing team, “a fantastic producer and production crew,” and “of course, planning, planning and more planning.”

To see his day-by-day rundown to the keynote, head over to The Lync Team Blog.

You might also be interested in:

Athima Chansanchai
Microsoft News Center Staff

↧

Innovación a bordo

February 20, 2014, 2:32 pm

≫ Next: How enterprise mobility cuts health costs while improving care

≪ Previous: Top Support Solutions for Microsoft SQL Server 2008

La industria aérea es una de las más competitivas y por eso la innovación debe ser una constante en las operaciones cotidianas de las aerolíneas. En el evento Singapore Airshow , socios de Microsoft presentaron soluciones que le permiten a estas compañías mejorar su servicio a clientes y entregarles una excelente experiencia de vuelo. Desde aplicaciones que facilitan la realización de trámites y pagos, hasta aquellas que brindan entretenimiento a los pasajeros mientras están a bordo, son algunas...(read more)

↧

How enterprise mobility cuts health costs while improving care

February 20, 2014, 3:06 pm

≫ Next: Top Support Solutions for Microsoft SharePoint Server 2010

≪ Previous: Innovación a bordo

Time is precious for a lot of things, but especially when it comes to saving lives. With enterprise mobility, health organizations can give their workforce instant access to information through mobile applications anywhere, anytime.

As the Windows Embedded blog explains, “Mobility is not just having a mobile device you carry with you; it can also be fixed devices that are located everywhere a user goes. In other words, you are the mobile part, finding devices where you need them.”

As an example, healthcare facilities with anywhere access to electronic health records (EHRs) that have patients’ information make it easier for clinicians to quickly make decisions and collaborate.

The blog goes in-depth into an example featuring HealthCast Inc., a Microsoft intelligent systems partner. It came up with a solution for Saint Luke’s Health System near Kansas City, Mo., which was “looking for a way to save medical staff time and help them better care for their patients without thinking about how to use the technology or having it slow them down.”

Saint Luke’s adopted HealthCast’s QwickACCESS solution, which features an enhanced single sign-on, utilizing Windows Embedded-based thin clients. It streamlines access to virtual and published desktops with the tap of a standard proximity badge. “This HealthCast solution is an intelligent system that automates access and security to EHR data at shared devices, so that clinicians can easily connect to and secure information residing on remote servers.”

These kinds of solutions can help keep costs under control while saving healthcare staff time, leading to more time for patient care. If you’re attending the Healthcare Information and Management Systems Society 2014 annual conference and exhibition (HIMSS), which begins Feb. 23, you can check out this intelligent system in the Microsoft or HealthCast booths.

Read more about Microsoft’s vision for healthcare and get more details on the HealthCast solution on the Windows Embedded blog.

You might also be interested in:

Athima Chansanchai
Microsoft News Center Staff

↧

‘Today Show’ co-host Natalie Morales plays ‘Mystery Skype’ with students

February 20, 2014, 3:12 pm

≫ Next: International Mother Language Day: spotlight on language efforts at Microsoft

≪ Previous: Top Support Solutions for Microsoft SharePoint Server 2010

Skype in the classroom is a great tool for bringing children together from around the world, and the “Mystery Skype” game makes such meetings even more fun and educational. The increasingly popular game has children ask questions to figure out the location of students in another classroom, as “Today Show” co-host Natalie Morales found out when she recently took part in such a session.

Morales saw how, “by asking a series of clever questions, the students could quickly guess where the other was located,” writes Wendy Norman on Skype’s Social Good blog. “And when the guessing was done, she enjoyed national songs performed by each of the countries’ students, in addition to a little language lesson before saying goodbye.”

Watch the video above to see Morales and Mystery Skype in action, and to read Norman’s post, head over to Skype’s Social Good blog.

You might also be interested in:

· Ask fashion designer Victoria Beckham your style questions on Skype
· Update to OneDrive for improved features on Windows Phone 8
· Office Online updates online experience with Office.com, Word, Excel, PowerPoint and OneNote

Suzanne Choney
Microsoft News Center Staff

↧

International Mother Language Day: spotlight on language efforts at Microsoft

February 20, 2014, 4:19 pm

≫ Next: Top Support Solutions for Microsoft SharePoint Server 2013

≪ Previous: ‘Today Show’ co-host Natalie Morales plays ‘Mystery Skype’ with students

February 21 is UNESCO’s International Mother Language Day , which promotes linguistic and cultural diversity and multilingualism. The theme of International Mother Language Day this year is “Local languages for global citizenship: spotlight on science.” Microsoft salutes this day and acknowledges the important role we play in bridging the gap between language and technology. Microsoft offers many resources to help bring localized software, devices and services to people in their...(read more)

↧