- Related Stories
-
Another security hole found in Excel
July 6, 2006 -
Windows, Office to get 'critical' fixes
July 6, 2006 -
Second zero-day Excel flaw emerges
June 20, 2006
The patches were delivered in seven security bulletins, five of which Microsoft deems "critical," its most serious rating. One of the urgent fixes addresses a flaw in a Windows component that could be used to spread a worm. Other updates deal with Office flaws that have already been used in targeted attacks.
Four updates tackled five Windows-related issues, including a security hole in a Windows component called "mailslot." The flaw poses the most severe risk in Tuesday's bunch, security specialist Symantec said in a statement. By sending a specially crafted network packet, an intruder could use the hole to remotely commandeer a vulnerable computer, without user interaction. The flaw affects Windows 2000, Windows XP and Windows Server 2003, Microsoft said in security bulletin MS06-035.
This means that the "mailslot" flaw could be exploited to launch a worm that could wreak havoc on the Internet. Because the flaw allows malicious code to execute without the PC owner doing anything, such as opening a file, it gives a worm a way to self-replicate.
"This vulnerability is the only worm candidate among the patched vulnerabilities today," Monty IJzerman, senior manager at McAfee Avert Labs said in a statement. Systems running Windows XP with Service Pack 2 and Windows Server 2003 with Service Pack 1 are at a lesser risk to this flaw because the operating systems do not have services listening on mailslots by default, according to Microsoft.
A "mailslot" is a temporary mechanism utilized by applications and operating system processes to facilitate unidirectional data transfer on Windows systems.
An error in the Windows Dynamic Host Configuration Protocol, or DHCP, client on the same systems similarly opens the door to a remote attack via a malicious network packet. However, an attacker has to be on the same subnetwork as the intended target, Microsoft said in bulletin MS06-036.
"Remotely exploitable vulnerabilities can pose a serious threat to organizations because they do not require user interaction and can be attacked from across the Internet," Dave Cole, director of Symantec Security Response, said in a statement.
Three of Microsoft's security bulletins address flaws in Office. Of those, one is dedicated to Excel and offers a fix for a total of eight flaws in the spreadsheet application. This includes patches for two so-called zero-day vulnerabilities that have already had attack code pushed out on the Internet.
All of the 13 Office-related vulnerabilities addressed by Tuesday's patches can be exploited by crafting a malicious Office document, according to Microsoft's security alerts. They could give complete control over a vulnerable system if the document is opened, the software maker said.
Office 2000 users are at higher risk because that version of the productivity software does not display an extra warning when it opens files from the Outlook e-mail client, Microsoft said. The Office and Excel flaws are detailed in security bulletins MS06-037, MS06-038 and MS06-039.
In addition to the five critical bulletins, Microsoft released two alerts labeled "important," one notch below the highest rating. Both primarily affect Web servers running Windows software.
One, MS06-034, addresses a flaw that primarily exposes Web servers that allow users to upload new content, Microsoft said. An attacker could upload a malformed ASP file and commandeer the server. The other, MS06-033, could allow an attacker to view the contents of the applications folder on a Web server.
Microsoft recommends that people install the critical fixes immediately. The updates are available via the Windows Update and Automatic Updates tools. Temporary workarounds are outlined in the security bulletins for those who can't immediately apply the patches.
See more CNET content tagged:
flaw, vulnerability, attacker, Web server, patch management
http://www.microsoft.com/technet/security/Bulletin/MS06-035.mspx
Skippy. But if you are so delusional as to think that M$ is going to
work in your best interest and actually produce a secure product,
you deserve the crap that you get from them.
Keep kidding yourselves Windozers, and enjoy the ride by Billy and
Stevie.
? Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 ? Download the update
? Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 ? Download the update
Don't get me wrong, MS definitely has done good by disabling this service by default and it will DRASTICALLY reduce the spread of worms if/when they arrive, however that doesn't mean that the problem doesn't exist. Servers in particular could be vulnerable to this as they are more likely to require this feature.
Windows, this is the number one method to stop worms and other
bad things from getting into XP. Just call it Swiftys SP3 for XP, push
the power button to Off, and step away from the shoddy software
box please. And go to town and buy a Macintosh while you still
have free time and money left.
- Basic security measures for Outlook
- by ml_ess July 12, 2006 9:59 AM PDT
- E-mail has always been a target for scheming hackers and fraudsters, attempting to spread all sorts of viruses, malware, phishing scams, etc.
- Like this Reply to this comment
-
(9 Comments)Part of the problem with e-mail is determining its authenticity - how do you know that the author is legitimate, until you open the message? Outlook users can start being proactive in protecting their computers and sensitive information. Spam filters do part of the job, but more advanced security protection should be implemented in order to protect your inbox from illegitimate senders and malicious correspondences.
http://www.essentialsecurity.com/FAQ.htm#1.4