Microsoft Fix Roundup: Server Flurry Slows Down

Security administrators had to be on their feet in early May to keep up with all the fixes to Microsoft Corp.'s server products. The last few weeks saw a big slowdown in major server fixes, although some newly discovered client vulnerabilities affect the enterprise.

Early in May, Microsoft released a fix for an IIS 5 vulnerability that could let an attacker take over a server, a fix for a domain controller vulnerability and Windows 2000 Service Pack 2.

Microsoft's three most recent security vulnerabilities hit the Windows Media Player, Word and Internet Explorer. Microsoft recommended customers immediately install the fixes for the Media Player and Word vulnerabilities as both allow attackers to execute code on a target system. Customers using IE only needed to consider the patch, in Microsoft's estimation.

The Media Player vulnerability affects version 6.4 and 7. Customers running Windows Media Player 6.4 were instructed to install the patch, while customers running version 7 were told to upgrade to version 7.1.

Through a buffer overrun, an attacker is able to execute any code on the machine. Mitigating factors are that the attacker must draw a user to a Web page or cause the user to open an HTML attachment. The attacker also must know the operating system being used.

The Word vulnerability allows an attacker to run macros without warning the user. The vulnerability relies on the way versions of Word prior to Word 2002 open Rich Text Format (RTF) documents.

The vulnerability affecting IE 5.01 and 5.5 allows spoofing of trusted Web sites.

"When IE is configured to perform certain types of checking on digital certificates provided by Web servers, it no longer performs other expected checks," Microsoft's bulletin explains. "This could potentially enable an attacker's Web site to masquerade as a trusted site."

The patch rolls in fixes for three other related vulnerabilities, including one that allows an attacker to spoof another site by making it appear that content on the attacker's site is coming from the other site.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

  • First Stable Chromium-Based Microsoft Edge Browser Released

    Microsoft on Wednesday announced the first release of its Chromium-based Microsoft Edge browser at the "stable" commercial-release stage.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.