Microsoft issues Windows, MSN Messenger updates |
 |
By Robert Westervelt, News Editor
11 Sep 2007 | SearchSecurity.com |
|
|
In a relatively light monthly bulletin release, Microsoft, Tuesday, issued an update to Windows 2000 that patches a critical flaw that could allow an attacker to gain remote access to a system.
Microsoft said a flaw in the way Microsoft Agent – the pesky paper clip that pops up in Microsoft Word – handles certain specially crafted URLs within Windows 2000, leaves the operating system vulnerable to attack. In its MS07-051 update, Microsoft said the vulnerability affects Microsoft Windows 2000 Service Pack 4.
"I refer to this as the return of Clippy," said Eric Schultze, chief security architect at Shavlik Technologies LLC, in Roseville, Minn. "If I visit a malicious Web site the exploit code can try to call Clippy and pass bad data to crash him and as a result, pass remote code onto a system."
Microsoft pulled back an update that would have plugged an elevation of privilege flaw affecting Windows SharePoint Services 3.0 on Windows Server 2003 and Office SharePoint Server 2007. Schultz said the flaw likely didn't pass a second or third round of testing. Instead, Schultze advised administrators to use the relatively light month to prepare for daylight saving time (DST) issues when clocks "fall back" in October.
Hardware purchased after the round of updates that address the DST issue could be at risk of having DST issues, Schultze said. Microsoft has released an updated DST patch to address the issue.
"Any computer purchased and installed since March doesn't have a patch on it," he said.
In addition to the Windows 2000 patch, the software giant issued three other security bulletins dealing with a remote code execution flaw in MSN Messenger and Windows Live Messenger, a code execution flaw in some installs of Visual Studio, and an elevation of privilege vulnerability in Windows Services for Unix 3.0. The updates were rated "important."
An MS07-054 update to MSN Messenger patches a flaw that could allow an attacker to conduct code execution remotely. In order for an attacker to pull off the exploit, a user must accept a video chat invitation.
The MS07-052 update addresses a code execution vulnerability existing on some systems when a custom version Crystal Reports is installed with some versions of Visual Studio. The vulnerability could allow remote code execution if a user opens a specially crafted RPT file.
MS07-053 addresses an elevation of privilege vulnerability in Windows Services for UNIX 3.0, Windows Services for UNIX 3.5, and Subsystem for UNIX-based Applications within Windows. The components are part of Windows Server 2003 and Windows Vista but are not installed by default.
Microsoft said no version of Windows is vulnerable to the MS07-052, the Crystal Reports for Visual Studio bulletin, and MS07-053, the Services for UNIX bulletin. But Microsoft said the updates should be applied if the Subsystem for UNIX-based Applications was enabled or if the Windows Services for UNIX 3.0 or 3.5 was installed.
|
