News
Microsoft Fix Roundup: Server Flurry Slows Down
- By Scott Bekker
- June 04, 2001
Security administrators had to be on their feet in early May to keep up with all the fixes to
Microsoft Corp.'s server products. The last few weeks saw a big slowdown in major server fixes, although some newly discovered client vulnerabilities affect the enterprise.
Early in May, Microsoft released a fix for an IIS 5 vulnerability that could let an attacker take over a server, a fix for a domain controller vulnerability and Windows 2000 Service Pack 2.
Microsoft's three most recent security vulnerabilities hit the Windows Media Player, Word and Internet Explorer. Microsoft recommended customers immediately install the fixes for the Media Player and Word vulnerabilities as both allow attackers to execute code on a target system. Customers using IE only needed to consider the patch, in Microsoft's estimation.
The Media Player vulnerability affects version 6.4 and 7. Customers running Windows Media Player 6.4 were instructed to install the patch, while customers running version 7 were told to upgrade to version 7.1.
Through a buffer overrun, an attacker is able to execute any code on the machine. Mitigating factors are that the attacker must draw a user to a Web page or cause the user to open an HTML attachment. The attacker also must know the operating system being used.
The Word vulnerability allows an attacker to run macros without warning the user. The vulnerability relies on the way versions of Word prior to Word 2002 open Rich Text Format (RTF) documents.
The vulnerability affecting IE 5.01 and 5.5 allows spoofing of trusted Web sites.
"When IE is configured to perform certain types of checking on digital certificates provided by Web servers, it no longer performs other expected checks," Microsoft's bulletin explains. "This could potentially enable an attacker's Web site to masquerade as a trusted site."
The patch rolls in fixes for three other related vulnerabilities, including one that allows an attacker to spoof another site by making it appear that content on the attacker's site is coming from the other site.
About the Author
Scott Bekker is editor in chief of Redmond Channel Partner magazine.