[es] - Microsoft warns of 4 new 'critical' Windows flaws

stinger
Luka Gerzic
DELTA M, IT Department
DELTA M HQ

Član broj: 126
Poruke: 1099
*.drenik.net

ICQ: 57419599
Sajt: www.gerzic.net

Profil

Microsoft warns of 4 new 'critical' Windows flaws

^{16.10.2003. u 11:48 - pre 249 meseci}

Thursday, October 16, 2003 Posted: 12:19 AM EDT (0419 GMT)

WASHINGTON (AP) -- Microsoft Corp. warned consumers Wednesday about four new flaws in its popular Windows software as the company shifted to monthly alerts for serious problems that could let hackers break into computers.

In particularly embarrassing disclosures, Microsoft acknowledged problems in its technology to authenticate software publishers over the Web and in its Windows help and support system.

The company said it did not believe hackers were yet exploiting any of the vulnerabilities it announced.

Microsoft said last week it will begin issuing monthly warnings and software patches, responding to frustration from technology managers who must apply sporadic patches each week across hundreds of computers inside corporations.

The company said it expects to release future warnings on the second Tuesday or Wednesday of each month. It has promised to rush out an emergency patch midmonth if it determines hackers are actively breaking into computers using a flaw it can repair immediately.

Separately, Microsoft began offering Windows XP users a single, convenient patch that combines 22 previous updates. It was aimed at customers who haven't diligently applied every software patch or who recently bought a new computer or recently installed Windows from scratch.

All four of the most dangerous new vulnerabilities affect versions of Windows 2000, which is commonly used by corporations and government agencies. Three of them also affect other Windows versions, including Microsoft's flagship Windows XP software, popular among home users, and Windows Server 2003 for businesses.

http://windowsupdate.microsoft.com/
Security Update for Microsoft Windows 2000 (KB828035)
Security Update for Microsoft Windows 2000 (KB825119)
Security Update for Microsoft Windows 2000 (KB826232)
Security Update for Microsoft Windows (KB823182)
Security Update for Microsoft Windows (KB824141)

Odgovor na temu

stinger
Luka Gerzic
DELTA M, IT Department
DELTA M HQ

Član broj: 126
Poruke: 1099
*.drenik.net

ICQ: 57419599
Sajt: www.gerzic.net

Profil

Re: Microsoft warns of 4 new 'critical' Windows flaws

^{16.10.2003. u 13:57 - pre 249 meseci}

Microsoft released a whole bunch of critical security updates. Out of these, MS03-043 is a flaw in the Windows Messenger Service (not MSN Messenger) with the possibility of a remote attacker gaining complete control of a Windows NT/2000/XP/2003 based PC remotely. If this sounds like another possible vector for a worm to spread, you'd probably be right. Microsoft's recommendation is to 'disable the Messenger Service immediately and evaluate their need to deploy the patch'. Of course a firewall will offer some protection but shouldn't be relied on. At least administrators can disable the Messenger Service remotely. Of course this is another headache for admins still patching for last month's RPC flaw

Microsoft Windows Security Bulletin Summary for October, 2003 Print
Issued: October 15, 2003
Version Number: 1.0
An End User version of this advisory is available at: http://www.microsoft.com/secur...bulletins/20031015_windows.asp.
Protect your PC: Microsoft has provided information on how you can help protect your PC at the following locations:
End Users can visit http://www.microsoft.com/protect
IT Professionals can visit http://www.microsoft.com/technet/security/protect
Patch Management Strategies: The Microsoft Guide to Security Patch Management Web Site provides additional information about Microsoft’s best practice recommendations for applying security patches.
IT Pro Security Zone Community: Learn to improve security and optimize your IT infrastructure, and participate with other IT Pros on security topics: http://www.microsoft.com/technet/security/community/default.mspx
Microsoft Security Notification Service: To receive automatic e-mail notification whenever Microsoft security bulletins are issued, subscribe to the Microsoft Security Notification Service: http://www.microsoft.com/technet/security/bulletin/notify.asp
Summary
Included in this advisory are updates for five newly discovered vulnerabilities in Microsoft Windows. These vulnerabilities, broken down by severity are:
Critical
Microsoft Security Bulletin MS03-041 - Vulnerability in Authenticode Verification Could Allow Remote Code Execution (823182)

http://www.microsoft.com/techn...security/bulletin/winoct03.asp

Microsoft Security Bulletin MS03-043 Print
Buffer Overrun in Messenger Service Could Allow Code Execution (828035)
Issued: October 15, 2003
Version Number: 1.0
Summary
Who Should Read This Document: Customers using Microsoft® Windows®
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical
Recommendation: Customers should disable the Messenger Service immediately and evaluate their need to deploy the patch
Patch Replacement: None
Caveats: None

http://www.microsoft.com/techn...security/bulletin/ms03-043.asp

Odgovor na temu