Welcome to this October Patch Tuesday Bulletin.  This month Microsoft has been fairly easy going with us.  We have 4 platforms with critical updates and although some are publicly released, none are being exploited.  In the chart below we list various versions of Office.  Please note that this includes Outlook, PowerPoint, Excel and Word.  This month Microsoft also listed Office 365 Pro Plus.  If you are running MS Office 2016 Click-to-Run (C2R) pay attention because Office 365 ProPlus is the same product formerly referred to as Microsoft Office 2016 Click-to-Run (C2R). The name has been updated in this chart to reflect Microsoft’s re-branding.  In our chart below you might be surprised to see a 2010 CVE listed under Exchange Server.  This wasn't by mistake.  Exchange Server was not identified as an in-scope product when CVE-2010-3190 was originally published and this vulnerability affects all installations of Exchange Server. So if you are running any version of Exchange server released prior to Exchange Server 2016 Cumulative Update 11 (as of this publishing, Cumulative Update 10 is the most recent cumulative update for Exchange 2016), the Visual Studio 2010 updates in MS11-025 should be applied to your Exchange Server.  Even though it's a fairly lite month please test and deploy updates to hosts that are affected by these vulnerabilities as soon as possible.

Over the years we've had millions of visitors to UltimateWindowsSecurity.com. Every month we have thousands and thousands of visitors to our Security Log Encyclopedia which documents all of the Security Log event ID’s for Windows Server OS’s. Back in 2007 when SharePoint added auditing capability, I realized that my audience not only needed the event information from SharePoint but I also found a similar need in SQL Server and Exchange. So not only did I document the data but I also started to develop the means to extract that event data from these applications so that it’s accessible and useable to the end user. Some 8 years later and LOGbinder is continuing to grow as companies realize LOGbinder bridges the gap between these applications and their infosec team. Visit LOGbinder.com to download a free 30-day fully functional trial and see the security event data that you have literally been missing.

So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month.