Microsoft patches Active Directory flaw
522714
(InfoWorld) - oMicrosoft released six sets of security patches Tuesday that address critical flaws in its products, including a bug in Active Directory software. The software vendor also fixed critical vulnerabilities in Excel and the .Net Framework as well as less-critical bugs in Microsoft Office Publisher, Internet Information Services (IIS), andÂ the Vista firewall. The six updates addressed a total of 11 bugs. The MS07-039 Active Directory update, which is for Windows 2000 Server and Windows Server 2003 systems, should be at the top of enterprise IT administrators' lists, said Eric Schultze, chief security architect with Shavlik Technologies. "That one scares me because those are the crown jewels there. And it looks like you're caught with your pants down at the moment." The flaw deals with the way Active Directory processes LDAP client requests. Attackers could create a malicious LDAP request that would then allow them to "take complete control of an affected system," Microsoft warned in its advisory on the flaw. Active Directory enables LDAP by default, but there are factors that mitigate a possible attack. The flaw can be exploited by an anonymous user attacking a Windows 2000 Server, but with Windows Server 2003 a hacker would need to have user credentials for the attack to work. Also, Windows Active Directory servers are typically protected by the firewall, so the attacker would most likely have to be inside the corporate network, Schultze said. The Excel and .Net Framework updates each fix three vulnerabilities in these products and are both rated critical by Microsoft because they could be exploited by attackers to install unauthorized software on a victim's computer. Two of the less-critical patches are also noteworthy. The MS07-041 patch fixes a flaw that could allow an attacker to take over a Windows XP-based Web server by sending specially crafted URLÂ requests. Microsoft rated this flaw as "important" rather than "critical," however, because it only affects XP systems, and IIS is not installed by default on XP. Microsoft also patched a flaw in the Windows Vista firewall. The bug, which is in Vista's Teredo IPv6 tunneling protocol, would allow an attacker to find out if a Vista computer is on the network. Normally the Vista firewall should simply block unsolicited traffic trying to communicate over the Teredo interface. The bug could not be exploited to take over a Vista machine and is considered low risk, Schultze said. "If Teredo is turned on, something within it would give a response back, even though the firewall is turned on," he said. Microsoft has released 41 updates so far in 2007. That's a little ahead of the 39 updates it had released by this time last year.
86995
Microsoft Corp. on Tuesday issued a trio of software updates to fix security holes in Windows computers, including one flaw that hackers are using to infiltrate PCs equipped with a massive security upgrade the company released just five months ago.
555449
Microsoft this week released a patch to fix an important vulnerability in Internet Explorer, even as a new worm that took advantage of an as-yet-unpatched hole in the Web browser spread.
713300
A stitch in time... Microsoft this week pushed out a patch to resolve a flaw in its patching system.â¦
659322
SEATTLE -- Microsoft Corp. released a critical security patch Wednesday to fix a flaw in its Internet Explorer Web browser that could allow an attacker to run malicious software on another person&#39;s computer.
323175
November 10, 2004 -- (WEB HOST INDUSTRY REVIEW) -- Software giant Microsoft  issued a patch for a flaw in Internet Security and Acceleration Server 2000 and Proxy Server 2.0 on Tuesday.
734229
Microsoft has released a "critical" patch to fix a security flaw affecting how Windows, Office and developer tools software programs process images in the JPEG image format.
314789
Recent updates to IE contain a serious regression that leaves systems once more vulnerable to a flaw fixed more than two years ago, according to security researchers.
362606
Microsoft issued a patch for a vulnerability in its server software that could allow an attacker to spoof trusted Internet content.
716380
Fix for critical security hole in Windows Media Format was added to Microsoft's Patch Tuesday updates at the last moment.
652845
InfoWorld - oMicrosoft released six sets of security patches Tuesday that address critical flaws in its products, including a bug in Active Directory software.
311958
Microsoft has released a patch for what it is calling a &quot;critical&quot; security flaw in the way many of its programs handle JPEG graphics files.
309807
Microsoft updates IE 7 due to performance issues with its phishing filter.
191229
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
476991
Microsoft Corp.  released on Tuesday a patch for its latest "critical" rated security flaw affecting its Windows, Office and developer tools software programs.
549045
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft has offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
166415
Microsoft has released an update to Internet Explorer to fix a security flaw that was discovered a month ago and has since been exploited to attack users.