Macrovision
Migrating Applications to New Operating System
Take the necessary steps for application management, from conversion
of legacy applications to MSI to customizing applications to fit
corporate standards. Don't overlook an important component of an OS
migration--join us for the free on-demand Web seminar.
http://list.windowsitpro.com/t?ctl=518F3:4160B336D0B60CB112FB244B53346504
=== SECURITY ALERT =============================================
6 Microsoft Security Bulletins for April 2007
by Orin Thomas, orin@windowsitpro.com
Microsoft released six security updates for April, rating five of them
as critical. Here's a brief description of each update; for more
information, go to
http://list.windowsitpro.com/t?ctl=518F4:4160B336D0B60CB112FB244B53346504
MS07-017: Vulnerabilities in GDI Could Allow Remote Code Execution
This update addresses several vulnerabilities, some of which have
been made public. Some of the vulnerabilities could be used to take
control of an affected computer. This bulletin was released on April 3
rather than as part of the normal Microsoft update release cycle. This
bulletin replaces bulletins MS06-001, MS06-054, and MS05-002.
Applies to: Windows 2000, Windows XP, Windows Server 2003, and
Windows Vista.
Recommendation: The fact that Microsoft released this update early
indicates the severity of the problem it addresses. If you haven't
deployed this update already, you should accelerate testing and
deployment of this update on vulnerable systems.
MS07-018: Vulnerabilities in Microsoft Content Management Server Could
Allow Remote Code Execution
This update addresses a remote code execution vulnerability and a
cross-site scripting and spoofing vulnerability. An attacker who is
able to exploit this vulnerability might be able to install programs or
modify data on the affected computer.
Applies to: Microsoft Content Management Server 2001 SP1 and Content
Management Server 2002 SP2
Recommendation: Although Microsoft rates this update as critical,
the vulnerabilities it addresses haven't been publicly disclosed. If
your organization uses the affected versions of Content Management
Server, you should test these updates and deploy them promptly.
MS07-019: Vulnerability in Universal Plug and Play Could Allow Remote
Code Execution
This update addresses a vulnerability in Windows XP's Universal Plug
and Play service. An attacker on the same subnet could send a specially
crafted HTTP request that could be used to take control of an affected
system.
Applies to: Windows XP
Recommendation: Although Microsoft rates this update as critical,
the vulnerability that it addresses has not been publicly disclosed. It
also applies only if the attacker is on the same subnet as the target
computer. You should promptly test and deploy this update on vulnerable
systems.
MS07-020: Vulnerability in Microsoft Agent Could Allow Remote Code
Execution
This update addresses a remote code execution vulnerability in
Microsoft Agent. The attack is of an indirect nature because it
requires a user to visit an attacker's Web site.
Applies to: Windows 2000, Windows XP, and Windows Server 2003
Recommendation: Although Microsoft rates this update as critical,
the vulnerability hasn't been publicly disclosed. You should promptly
test and deploy this update on vulnerable systems.
MS07-021: Vulnerabilities in CSRSS Could Allow Remote Code Execution
This update addresses vulnerabilities in the Windows Client/Server
Run-time Subsystem. An attacker could create an application that
exploits this vulnerability to allow remote control of an affected
system.
Applies to: Windows 2000, Windows XP, Windows Server 2003, and
Windows Vista
Recommendation: Microsoft rates this update as critical because the
details of this vulnerability have been publicly reported. You should
accelerate testing and deployment of this update on vulnerable systems.
MS07-022: Vulnerability in Windows Kernel Could Allow Elevation of
Privilege
This privilege elevation vulnerability in the Windows Kernel could
be exploited to take control of an affected system. Exploiting this
vulnerability requires that the attacker have direct access to the
computer. This bulletin replaces MS06-049.
Applies to: Windows 2000, Windows XP, and Windows Server 2003. The
64-bit editions of these OSs aren't vulnerable.
Recommendation: Microsoft rates this bulletin as important. You
should test and deploy this update as part of your normal patch
management cycle.
================================================================
Security UDPATE is brought to you by the Windows IT Pro Web site's
Security page (first URL below) and Security Pro VIP (second URL
below).
http://list.windowsitpro.com/t?ctl=518F7:4160B336D0B60CB112FB244B53346504
http://list.windowsitpro.com/t?ctl=518F9:4160B336D0B60CB112FB244B53346504
Subscribe to Security UPDATE at
http://list.windowsitpro.com/t?ctl=518F6:4160B336D0B60CB112FB244B53346504
Unsubscribe by clicking
http://list.windowsitpro.com/u?id=4160B336D0B60CB112FB244B53346504
Be sure to add Security_UPDATE@list.windowsitpro.com
to your antispam software's list of allowed senders.
To contact us:
About Security UPDATE content -- letters@windowsitpro.com
About technical questions -- http://list.windowsitpro.com/t?ctl=518F8:4160B336D0B60CB112FB244B53346504
About your product news -- products@windowsitpro.com
About your subscription -- windowsitproupdate@windowsitpro.com
About sponsoring Security UPDATE -- salesopps@windowsitpro.com
View the Windows IT Pro privacy policy at
http://list.windowsitpro.com/t?ctl=518F5:4160B336D0B60CB112FB244B53346504
Windows IT Pro, a division of Penton Media, Inc.
221 East 29th Street, Loveland, CO 80538
Attention: Customer Service Department
Copyright 2007, Penton Media, Inc. All rights reserved.
No comments:
Post a Comment