Malwareteks

Newsfeeds

Latest Security Advisories

Microsoft Security Advisory (951306): Vulnerability in Windows Could Allow Elevation of Privilege - 10/9/2008
Revision Note: October 9, 2008: Added information regarding the public availability of exploit code. Advisory Summary:Security Advisory
Microsoft Security Advisory (953839): Cumulative Security Update of ActiveX Kill Bits - 8/13/2008
Revision Note: August 13, 2008: Updated to include links to HP’s Advisories Advisory Summary:Microsoft is releasing a new set of ActiveX kill bits with this advisory.
Microsoft Security Advisory (955179): Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution - 8/12/2008
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a private report of this vulnerability. We have issued MS08-041 to address this issue. For more information about this issue, including download links for an available security update, please review MS08-041. The vulnerability addressed is the Snapshot Viewer Arbitrary File Download Vulnerability - CVE-2008-2463.
Microsoft Security Advisory (954960): Microsoft Windows Server Update Services (WSUS) Blocked from Deploying Security Updates - 8/12/2008
Revision Note: August 12, 2008: Added entry to the section, Frequently Asked Questions (FAQ) Related to This Security Update to communicate that the re-release of the update to fix a known installation issue with Windows Server 2008 systems is now available via Microsoft Update. Advisory Summary:Microsoft has completed the investigation into public reports of a non-security issue that prevents the distribution of any updates deployed through Microsoft Windows Server Update Services 3.0 or Microsoft Windows Server Update Services 3.0 Service Pack 1 to client systems that have Microsoft Office 2003 installed in their environment. Microsoft confirmed those reports and has released an update to correct this issue under Microsoft Knowledge Base Article 954960. Microsoft encourages customers affected by this issue to review and install this update.
Microsoft Security Advisory (953635): Vulnerability in Microsoft Word Could Allow Remote Code Execution - 8/12/2008
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS08-042 to address this issue. For more information about this issue, including download links for an available security update, please review MS08-042. The vulnerability addressed is the Word Record Parsing Vulnerability - CVE-2008-2244.
Microsoft Security Advisory (956187): Increased Threat for DNS Spoofing Vulnerability - 7/25/2008
Revision Note: July 25, 2008: Advisory published. Advisory Summary:Microsoft released Microsoft Security Bulletin MS08-037, Vulnerabilities in DNS Could Allow Spoofing (953230), on July 8, 2008, offering security updates to protect customers against Windows Domain Name System (DNS) spoofing attacks. Microsoft released this update in coordination with other DNS vendors who were also similarly impacted. Since the coordinated release of these updates, the threat to DNS systems has increased due to a greater public understanding of the attacks, as well as detailed exploit code being published on the Internet.
Microsoft Security Advisory (953818): Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform - 7/2/2008
Revision Note: July 2, 2008: Updated the Suggested Actions. Advisory Summary:Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Safari is not installed with Windows XP or Windows Vista by default; it must be installed independently or through the Apple Software Update application. Customers running Safari on Windows should review this advisory.
Microsoft Security Advisory (954462): Rise in SQL Injection Attacks Exploiting Unverified User Data Input - 6/25/2008
Revision Note: June 25, 2008: Removed erroneous references to form field and cookie value testing from the HP Scrawlr tool description. Advisory Summary:Microsoft is aware of a recent escalation in a class of attacks targeting Web sites that use Microsoft ASP and ASP.NET technologies but do not follow best practices for secure Web application development. These SQL injection attacks do not exploit a specific software vulnerability, but instead target Web sites that do not follow secure coding practices for accessing and manipulating data stored in a relational database. When a SQL injection attack succeeds, an attacker can compromise data stored in these databases and possibly execute remote code. Clients browsing to a compromised server could be forwarded unknowingly to malicious sites that may install malware on the client machine.
Microsoft Security Advisory (954474): System Center Configuration Manager 2007 Blocked from Deploying Security Updates - 6/17/2008
Revision Note: June 17, 2008: Advisory updated to reflect availability of fix. Advisory Summary:Microsoft has completed the investigation into public reports of a non-security issue that affects environments with all supported versions of System Center Configuration Manager 2007 that deploy updates to Systems Management Services (SMS) 2003 clients. Microsoft has confirmed those reports and has released an update to correct this issue under Microsoft Knowledge Base Article 954474. Microsoft encourages customers affected by this issue to review and install this update.
Microsoft Security Advisory (950627): Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution - 5/13/2008
Revision Note: May 13, 2008: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into public reports of this vulnerability. We have issued Microsoft Security Bulletin MS08-028 to address this issue. For more information about this issue, including download links for an available security update, please review MS08-028: Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution (950749). The vulnerability addressed is the Microsoft Jet Engine MDB File Parsing Stack Overflow Vulnerability - CVE-2007-6026.
Microsoft Security Advisory (932596): Update to Improve Kernel Patch Protection - 4/23/2008
Revision Note: April 23, 2008: Added an FAQ entry about known issues in installing the kernel update Advisory Summary:Security Advisory
Microsoft Security Advisory (947563): Vulnerability in Microsoft Excel Could Allow Remote Code Execution - 3/12/2008
Revision Note: Advisory updated to reflect the correct Excel file formats in the MOICE Workarounds section. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS08-014 to address this issue. For more information about this issue, including download links for an available security update, please review MS08-014. The vulnerability addressed is the Microsoft Excel Vulnerability - CVE-2008-0081.
Microsoft Security Advisory (945713): Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure - 1/9/2008
Revision Note: Advisory Updated: The registry key for the Configure a Domain Suffix Search List workaround has been corrected to the proper key of SearchList. Advisory Summary:Microsoft is investigating new public reports of a vulnerability in the way Windows resolves hostnames that do not include a fully-qualified domain name (FQDN). The technology that the vulnerability affects is Web Proxy Auto-Discovery (WPAD). Microsoft has not received any information to indicate that this vulnerability has been publicly used to attack customers, and Microsoft is not aware of any customer impact at this time. Microsoft is aggressively investigating the public reports. Customers whose domain name begins in a third-level or deeper domain, such as “contoso.co.us”, or for whom the following mitigating factors do not apply, are at risk from this vulnerability.
Microsoft Security Advisory (943411): Update to Improve Windows Sidebar Protection - 1/8/2008
Revision Note: Advisory Published. Advisory Summary:An update is available for currently supported editions of the Windows Vista operating system. The update to improve Windows Sidebar Protection enables Windows Sidebar to help block gadgets from running in Sidebar. For more information about installing this update, see Microsoft Knowledge Base Article 943411.
Microsoft Security Advisory (944653): Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege - 12/11/2007
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS07-067 to address this issue. For more information about this issue, including download links for an available security update, please review MS07-067. The vulnerability addressed is the Macrovision Driver Vulnerability - CVE-2007-5587.
Microsoft Security Advisory (943521): URL Handling Vulnerability in Windows XP and Windows Server 2003 with Windows Internet Explorer 7 Could Allow Remote Code Execution - 11/13/2007
Revision Note: Advisory updated to reflect publication of security bulletin Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS07-061 to address this issue. For more information about this issue, including download links for an available security update, please review MS07-061. The vulnerability addressed is the Windows URI Handling Vulnerability - CVE-2007-3896.
Microsoft Security Advisory (927891): Update for Windows Installer (MSI) - 5/24/2007
Revision Note: Advisory updated to change title from "Fix for Windows Installer (MSI)" to "Update for Windows Installer (MSI)," make minor edits, and remove unnecessary FAQ. Advisory Summary:Today we are announcing the availability of an update that does not address a security vulnerability, but is a high priority for customers in keeping their systems updated.
Microsoft Security Advisory (937696): Release of Microsoft Office Isolated Conversion Environment (MOICE) and File Block Functionality for Microsoft Office - 5/21/2007
Revision Note: Advisory Published: May 21, 2007 Advisory Summary:Security Advisory
Microsoft Security Advisory (933052): Vulnerability in Microsoft Word Could Allow Remote Code Execution - 5/9/2007
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS07-024 to address this issue. For more information about this issue, including download links for an available security update, please review MS07-024.
Microsoft Security Advisory (935964): Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution - 5/8/2007
Revision Note: Advisory updated. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS07-029 to address this issue. For more information about this issue, including download links for an available security update, please review MS07-029. The vulnerability addressed is the DNS RPC Management Vulnerability - CVE-2007-1748.
Microsoft Security Advisory (935423): Vulnerability in Windows Animated Cursor Handling - 4/3/2007
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. We have issued MS07-017 to address this issue.
Microsoft Security Advisory (932553): Vulnerability in Microsoft Office Could Allow Remote Code Execution - 2/13/2007
Revision Note: Advisory updated to reflect publication of security bulletin Advisory Summary:Security Advisory
Microsoft Security Advisory (932114): Vulnerability in Microsoft Word 2000 Could Allow Remote Code Execution - 2/13/2007
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Security Advisory
Microsoft Security Advisory (929433): Vulnerability in Microsoft Word Could Allow Remote Code Execution - 2/13/2007
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Security Advisory
Microsoft Security Advisory (927709): Vulnerability in Visual Studio 2005 Could Allow Remote Code Execution - 12/12/2006
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft is investigating public reports of a vulnerability in Visual Studio 2005
Microsoft Security Advisory (930181): Exploit Code Published Affecting Windows Client Server Run-Time Subsystem - 11/16/2006
Revision Note: Advisory published. Advisory Summary:Security Advisory
Microsoft Security Advisory (927892): Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution - 11/14/2006
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS06-071 to address this issue. For more information about this issue, including download links for an available security update, please review MS06-071.
Microsoft Security Advisory (925444): Vulnerability in the Microsoft DirectAnimation Path ActiveX Control Could Allow Remote Code Execution - 11/14/2006
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of this vulnerability. We have issued MS06-067 to address this issue. For more information about this issue, including download links for an available security update, please review MS06-067. The vulnerability addressed is the DirectAnimation Path ActiveX Vulnerability - CVE-2006-4777.
Microsoft Security Advisory (925143): Adobe Security Bulletin: APSB06-11 Flash Player Update to Address Security Vulnerabilities - 11/14/2006
Revision Note: Advisory updated to reflect publication of security bulletin. Advisory Summary:Microsoft has completed the investigation of security vulnerabilities in Macromedia Flash Player from Adobe, a third party software application that also was redistributed with Windows XP Service Pack 2 and Windows XP Professional x64 Edition. We have issued MS06-069 to address these issues. For more information about these issues, including download links for an available security update, please review MS06-069. This bulletin is for customers using Macromedia Flash Player version 6 from Adobe. The vulnerabilities addressed are the Macromedia Flash Player Vulnerabilities – CVE-2006-3014, CVE-2006-3311, CVE-2006-3587, CVE-2006-3588, and CVE-2006-4640. Customers that have followed the guidance in Adobe Security Bulletin APSB06-11, issued September 12, 2006, are not at risk from these vulnerabilities.
Microsoft Security Advisory (917021): Description of the Wi-Fi Protected Access 2 support for Wireless Group Policy in Windows XP Service Pack 2 - 10/17/2006
Revision Note: Advisory Published. Advisory Summary:Microsoft is releasing this security advisory to inform customers about an update that enables Wi-Fi Protected Access 2 (WPA2) support for Wireless network Group Policy settings in Windows XP Service Pack 2. This update is being released to provide parity between Windows XP Service Pack 2 (before a broad release vehicle, like a service pack, is released) and the upcoming release of Windows Server 2003 Service Pack 2. With this update, customers can create Wireless network Group Policy settings to simultaneously manage WPA2 on systems running Windows XP Service Pack 2 and for any versions of Windows targeted by the upcoming Windows Server 2003 Service Pack 2. Also included in this update are Wireless client behavior changes for non-broadcast and ad-hoc networks. These defense-in-depth changes are intended to help prevent systems from connecting to networks other than those a user intends to connect to. The reason these defense-in-depth changes are included in this update in addition to the WPA2 support for Wireless network Group Policy is to provide parity between the two Windows versions. This makes it possible to manage WPA2 settings for wireless clients on different Windows versions using the same Wireless Group Policy. These defense-in-depth changes will be included in Windows 2003 Service Pack 2 as part of the same WPA2 support for Wireless network Group Policy settings. For more information about the upcoming Windows 2003 Service Pack 2 see the Windows Service Pack Road Map. The broad release vehicle is still considered to be a service pack for Windows XP for the defense-in-depth changes included in update 917021.
Microsoft Security Advisory (926043): Vulnerability in Windows Shell Could Allow Remote Code Execution - 10/10/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Microsoft is investigating new public reports of a vulnerability in supported versions of Microsoft Windows. Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. We are also aware of proof of concept code published publicly and limited attacks. We are aware of Web sites attempting to use the reported vulnerability to install malware. Our investigation into these Web sites shows that, in most cases, attempts to install malicious software by exploiting this vulnerability fail. This is due to specific technical factors related to the vulnerability. We will continue to investigate these public reports. The ActiveX control called out in the public reports and in the Proof of Concept code is the Microsoft WebViewFolderIcon ActiveX control (Web View). The vulnerability exists in Windows Shell and is exposed by Web View. We are working on a security update currently scheduled for an October 10 release. Customers are encouraged to keep their anti-virus software up to date. Microsoft encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources. For more information about Safe Browsing, visit the Trustworthy Computing Web site. We continue to encourage customers to follow our Protect Your PC guidance of enabling a firewall, applying software updates and installing antivirus software. Customers can learn more about these steps at the Protect Your PC Web site. Customers who believe they have been attacked should contact their local FBI office or post their complaint on the Internet Fraud Complaint Center Web site. Customers outside the U.S. should contact the national law enforcement agency in their country. Services. You can contact Product Support Services in the United States and Canada at no charge using the PC Safety line (1 866-PCSAFETY). Customers outside of the United States and Canada can loc
Microsoft Security Advisory (925984): Vulnerability in PowerPoint Could Allow Remote Code Execution - 10/10/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft PowerPoint 2000, Microsoft PowerPoint 2002, Microsoft Office PowerPoint 2003, Microsoft PowerPoint 2004 for Mac, and Microsoft PowerPoint 2004 v. X for Mac. In order for this attack to be carried out, a user must first open a malicious PowerPoint file attached to an e-mail or otherwise provided to them by an attacker. As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources. Microsoft has added detection to the Windows Live OneCare safety scanner for up-to-date removal of malicious software that attempts to exploit this vulnerability. Microsoft is also actively sharing information with Microsoft Security Response Alliance partners so that their detection can be up to date to detect and remove attacks. Customers in the U.S. and Canada who believe they are affected can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Microsoft Security Advisory (925059): Vulnerability in Word Could Allow Remote Code Execution - 10/10/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Security Advisory
Microsoft Security Advisory (925568): Vulnerability in Vector Markup Language Could Allow Remote Code Execution - 9/26/2006
Revision Note: Advisory Updated Advisory Summary:Microsoft is investigating new public reports of vulnerability using the Vector Markup Language on Microsoft on Windows 2000 Service Pack 4, on Windows XP Service Pack 1 and Service Pack 2, Windows Server 2003 and Windows Server 2003 Service Pack 1.
Microsoft Security Advisory (922582): Update for Windows - 9/12/2006
Revision Note: Advisory published Advisory Summary:Today we are announcing the availability of an update that does not address a security vulnerability, but is a high priority for customers in keeping their systems updated. The update addresses the following issue: You may receive error code 0x80070002 when you try to update a computer running on Microsoft Windows that has a minifilter-based application installed. This error code could occur when updating using any of the following Microsoft tools: Automatic Updates, Windows Update Web site, Microsoft Update Web site, Inventory Tool for Microsoft Updates (ITMU) for Microsoft Systems Management Server (SMS) 2003, Software Update Services (SUS) 1.0, Windows Server Update Services (WSUS) 2.0. Currently, File Server Resource Manager (FSRM) is the only known minifilter-based application that can cause this behavior and is only available in Windows Server 2003 R2. However, many companies are developing minifilter-based applications that will be available in the near future. We encourage Windows customers to review and install this update. This update will be offered automatically through Automatic Updates. This update has been designed to install successfully even if a minifilter driver is installed that is preventing other updates from installing. For more information about this issue, including download links for the available non-security update, please review Microsoft Knowledge Base Article 922582.
Microsoft Security Advisory (923762): Long URLs to sites using HTTP 1.1 and compression Could Cause Internet Explorer 6 Service Pack 1 to Unexpectedly Exit - 8/24/2006
Revision Note: Advisory updated to direct customers to the revised version of Microsoft Security Bulletin MS06-042 that includes new updates for Internet Explorer 6 Service Pack 1. Advisory Summary:Microsoft announced last week that it would be re-releasing MS06-042 Tuesday, August 22, 2006 to address an issue affecting Internet Explorer 6 Service Pack 1 customers discussed in Microsoft Knowledge Base Article 923762. Due to an issue discovered in final testing, Microsoft will not be re-releasing MS06-042 today. This update will be re-released for Internet Explorer 6 Service Pack 1 when it meets an appropriate level of quality for broad distribution. Microsoft is also aware of public reports that this issue can lead to a buffer overrun condition for Internet Explorer 6 Service Pack 1 customers that have MS06-042 applied. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time. Microsoft is aggressively investigating the public reports. Only customers using Internet Explorer 6.0 SP1 are affected, all other customers should continue their deployments of MS06-042. Customers using Internet Explorer 6.0 SP 1 should continue their deployment of MS06-042 and follow the existing guidance provided in Knowledge Base article 923762 and the Suggested Actions section of this Security Advisory.
Microsoft Security Advisory (922437): Exploit Code Published Affecting the Server Service - 8/13/2006
Revision Note: Advisory published. Advisory Summary:Security Advisory
Microsoft Security Advisory (922970): Vulnerability in PowerPoint Could Allow Remote Code Execution - 8/11/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Security Advisory
Microsoft Security Advisory (921365): Vulnerability in Excel Could Allow Remote Code Execution - 7/11/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Security Advisory
Microsoft Security Advisory (921923): Proof of Concept Code Published Affecting the Remote Access Connection Manager Service - 6/23/2006
Revision Note: Advisory Summary:Security Advisory
Microsoft Security Advisory (919637): Vulnerability in Word Could Allow Remote Code Execution - 6/13/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of a vulnerability. We have issued a security bulletin to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin.
Microsoft Security Advisory (914784): Update to Improve Kernel Patch Protection - 6/13/2006
Revision Note: Advisory published. Advisory Summary:An update is available for Kernel patch protection included with Windows Server 2003 SP1 and later versions of Windows for x64-based systems. Kernel patch protection protects code and critical structures in the Windows kernel from modification by unknown code or data. This update adds additional checks to this protection for increased reliabilty, performance, and security. For more information about this release, see Microsoft Knowledge Base Article 914784.
Microsoft Security Advisory (912945): Non-Security Update for Internet Explorer - 6/13/2006
Revision Note: Advisory updated to advise of the release of Microsoft Security Bulletin MS06-021. Advisory Summary:Microsoft Security Bulletin MS06-021 has been released and replaces Microsoft Security Bulletin MS06-013. The Compatibility Patch discussed in Microsoft Knowledge Base Article 917425 is also replaced by this security update. The changes to the way Internet Explorer handles ActiveX controls is made permanent by the updates included with Microsoft Security Bulletin MS06-021. Microsoft originally released this security advisory discussing non-security update 912945 for Internet Explorer on February 28, 2006. This non-security update includes minor changes to how Internet Explorer handles some Web pages that use ActiveX controls and is being distributed to customers in phases. On Jan 9, 2006, Microsoft released this non-security update for Internet Explorer 6 for Windows XP Service Pack 2 to MSDN subscribers. On Feb 9, 2006 the same update became publicly available on MSDN. On February 28th it was distributed as a recommended update on Windows Update for Windows XP Service Pack 2 and for Windows Server 2003 Service Pack 1. For the final phase of distribution, this non-security update is included in Microsoft Security Bulletin MS06-013, released on April 11, 2006. This security update replaces non-security update 912945 for Internet Explorer. For more information about this non-security update for Internet Explorer, see Microsoft Knowledge Base Article 912945. Although most Internet sites have already prepared for the changes in the way that Internet Explorer handles some ActiveX controls, some enterprise customers have given feedback that more time is needed to ensure that corporate line-of-business applications are compatible with this change to Internet Explorer. Compatibility Patch – To help enterprise customers who need more time to prepare for the ActiveX update changes discussed in Microsoft Knowledge Base Article 912945 and included in Microsoft Security Bulletin MS06-013, Microsoft is releasing a Compatibility Patch on April 11, 2006. As soon as it is deployed,
Microsoft Security Advisory (916208): Adobe Security Bulletin: APSB06-03 Flash Player Update to Address Security Vulnerabilities - 5/11/2006
Revision Note: Advisory published. Advisory Summary:Microsoft is aware of recent security vulnerabilities in Macromedia Flash Player, a third party software application that also was redistributed with Microsoft Windows XP Service Pack 1, Windows XP Service Pack 2, Windows 98, Windows 98 SE, and Windows Mi
Microsoft Security Advisory (910550): Macromedia Security Bulletin: MPSB05-07 Flash Player 7 Improper Memory Access Vulnerability - 5/11/2006
Revision Note: Advisory published. Advisory Summary:Microsoft is aware of recent security vulnerabilities in Macromedia Flash Player, a third party software application that also was redistributed with Microsoft Windows XP Service Pack 1, Windows XP Service Pack 2, Windows 98, Windows 98 SE, and Windows Millennium Edition. The Microsoft Security Response Center is in communication with Macromedia and is aware that Macromedia has made updates that are available on their Web site. Microsoft encourages customers who use Macromedia Flash Player to follow the guidance documented in Macromedia’s Security Bulletin. The Macromedia Security Bulletin describes the vulnerabilities and provides the download locations so that you can install the appropriate update based on the version of Macromedia Flash Player you are using. If customers are not using Macromedia Flash Player on their system, or customers do not need Macromedia Flash Player, they can disable the ActiveX control in Internet Explorer to help protect against these vulnerabilities. See the Workarounds section in this advisory for ways to implement this change.
Microsoft Security Advisory (917077): Vulnerability in the way HTML Objects Handle Unexpected Method Calls Could Allow Remote Code Execution - 4/11/2006
Revision Note: Advisory updated to reference released security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of a vulnerability. We have issued a security bulletin to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin.
Microsoft Security Advisory (914457): Vulnerability in Windows Service ACLs - 3/14/2006
Revision Note: March 14, 2006: Advisory updated to reference released security bulletin. Advisory Summary:Microsoft has completed the investigation into a public report of a vulnerability. We have issued a security bulletin to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin.
Microsoft Security Advisory (906267): A COM Object (Msdds.dll) Could Cause Internet Explorer to Unexpectedly Exit - 2/21/2006
Revision Note: Advisory updated to include additional mitigating factors. Msdds.dll file versions have also been revised: updated file version from 7.0.9446.0 to 7.0.9466.0 and added file version 7.0.9064.9143. Advisory Summary:Microsoft is investigating new public reports of a possible vulnerability in Internet Explorer. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time. Microsoft is aggressively investigating the public reports. The Microsoft DDS Library Shape Control (Msdds.dll) is a COM object that could, when called from a Web page displayed in Internet Explorer, cause Internet Explorer to unexpectedly exit. This condition could potentially allow remote code execution if a user visited a malicious Web site. This COM Object is not marked safe for scripting and is not intended for use in Internet explorer. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Microsoft Security Advisory (913333): Vulnerability in Internet Explorer Could Allow Remote Code Execution - 2/14/2006
Revision Note: Advisory Published Advisory Summary:Microsoft is investigating new public reports of a vulnerability in older versions of Microsoft Internet Explorer. Based on our investigation, this vulnerability could allow an attacker to execute arbitrary code on the user's system in the security context of the logged-on user. The attacker could do this by one or more of the following actions: By hosting a specially crafted Windows Metafile (WMF) image on a malicious Web site; By convincing a user to open a specially crafted e-mail attachment; By convincing a user to click on a link in an e-mail message that takes the user to a malicious Web site; or By sending a specially crafted e-mail message to Outlook Express users, which they view in the preview pane. Note This is not the same issue as the one addressed by Microsoft Security Bulletin MS06-001 (912919). The vulnerability exists in: Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 and Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium. Microsoft has determined that an attacker who exploits this vulnerability would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's Web site. It could also be possible to display specially crafted Web content by using banner advertisements or by using other methods to deliver Web content to affected systems. In an e-mail based attack, customers would have to click a link to the malicious Web site, preview a malicious e-mail message, or open an attachment that exploited the vulnerability. In both Web-based and e-mail based attacks, the code would execute in the security context of the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft will continue to investigate these reports and provide additional guid
Microsoft Security Advisory (904420): Win32/Mywife.E@mm - 2/1/2006
Revision Note: Additional information about the blank password restriction functionality in Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003, and Windows Server 2003 Service Pack 1. Added link to Virus Information Alliance member Sophos. Advisory Summary:Microsoft wants to make customers aware of the Mywife mass mailing malware variant named Win32/Mywife.E@mm. The mass mailing malware tries to entice users through social engineering efforts into opening an attached file in an e-mail message. If the recipient opens the file, the malware sends itself to all the contacts that are contained in the system’s address book. The malware may also spread over writeable network shares on systems that have blank administrator passwords. Customers using Windows XP Service Pack 1, Windows XP Service Pack 2, Windows Server 2003, or Windows Server 2003 Service Pack 1 may be at reduced risk from this malware; if the account password is blank, the account is not valid as a network credential. In an environment where you can guarantee physical security, you do not need to use the account across the network, and you are using Windows XP or Windows Server 2003, a blank password is better than a weak password. By default, blank passwords can only be used locally in Windows XP and Windows Server 2003. Customers who are using the most recent and updated antivirus software could be at a reduced risk of infection from the Win32/Mywife.E@mm malware. Customers should verify this with their antivirus vendor. Antivirus vendors have assigned different names to this malware but the Common Malware Enumeration (CME) group has assigned it ID CME-24. On systems that are infected by Win32/Mywife@E.mm, the malware is intended to permanently corrupt a number of common document format files on the third day of every month. February 3, 2006 is the first time this malware is expected to permanently corrupt the content of specific document format files. The malware also modifies or deletes files and registry keys associated with certain computer security-related applications. This prevents these applications from running when Windows starts. For more information, see the Microsoft Virus Encyclopedia.
As with all currently known variants of the Mywife malware,