Microsoft has released some security updates today:
Today, 10 February 2004 Microsoft is releasing three new security bulletins.
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity rating of Critical
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity rating of Important
- One Microsoft Security Bulletin affecting Microsoft Virtual PC for the Macintosh with a maximum severity rating of Important
Summaries for the bulletins released today may be found at the following pages:
- Microsoft Windows
http://www.microsoft.com/technet/security/bulletin/winfeb04.asp
- Microsoft Virtual PC for the Macintosh
http://www.microsoft.com/technet/security/bulletin/macfeb04.asp
In addition one bulletin has been re-issued, MS03-051, affecting Microsoft FrontPage Server Extensions. Information on the re-issued bulletin may be found at:
- http://www.microsoft.com/technet/security/bulletin/MS03-051.asp
Please also see below for each of the individual Microsoft Security Bulletins listed above in the summaries.
Microsoft will also be hosting a webcast tomorrow to address customer questions on these bulletins. For more information on this webcast please see below:
Information about Microsoft's February Security Bulletins
11 February 2004 10:00 AM - 2/11/2004 11:00 AM PST
- http://go.microsoft.com/fwlink/?LinkId=22796
The on-demand version of the webcast will be available 24 hours after the live webcast at:
- http://go.microsoft.com/fwlink/?LinkId=22796
**********************************************************************
TECHNICAL DETAILS
MS04-005
Title: Vulnerability in Virtual PC could lead to privilege elevation
Affected Software:
Microsoft Virtual PC for the Macintosh 6.0 Microsoft Virtual PC for the Macintosh 6.01 Microsoft Virtual PC for the Macintosh 6.02 Microsoft Virtual PC for the Macintosh 6.1
Impact of Vulnerability: Local elevation of Privilege
Maximum Severity Rating: Important
Restart required: No
Update can be uninstalled: No
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-005.asp
**********************************************************************
MS04-006
Title: Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution
Affected Software:
Microsoft Windows NT Workstation 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Windows XP 64-Bit Edition Version 2003
Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1
Microsoft Windows Server 2003
Microsoft Windows Server 2003 64-Bit
Edition Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Important
Restart required: Yes
Update can be uninstalled: Yes
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-006.asp
**********************************************************************
MS04-007
Title: ASN .1 Vulnerability Could Allow Code Execution
Affected Software:
Microsoft Windows NT Workstation 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Windows XP 64-Bit Edition Version 2003
Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1
Microsoft Windows Server 2003
Microsoft Windows Server 2003 64-Bit
Edition Affected Components:
Microsoft ASN.1 Library
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical
Restart required: Yes
Update can be uninstalled: Yes
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-007.asp
**********************************************************************
MS03-051
Title: Buffer Overrun in Microsoft FrontPage Server Extensions Could Allow Code Execution
Affected Software:
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Office XP
Microsoft Office XP Service Pack 1
Microsoft Office XP Service Pack 2
Affected Components:
Microsoft FrontPage Server Extensions 2000 (For Windows NT4) and Microsoft Office 2000 Server Extensions (Shipped with Office 2000
Microsoft FrontPage Server Extensions 2000 (Shipped with Windows 2000)
Microsoft FrontPage Server Extensions 2000 (Shipped with Windows XP)
Microsoft FrontPage Server Extensions 2002
Microsoft SharePoint Team Services 2002 (Shipped with Office XP)
Reason for Re-issue: Subsequent to the release of this bulletin, it was found that the vulnerability discussed in MS03-051 affects additional versions of the affected products and components. Specifically, it has been found to also affect Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1, and Microsoft Office 2000 Server Extensions. Microsoft has updated the bulletin with additional information and posted security updates for these versions.
Customers should review the updated security bulletin to determine if they use any of the additionally affected versions of the affected product and components and apply the security update if they do. Customers who do not use any of the additionally affected versions of the affected product and components but applied the previously released security updates do not need to take any action.
More information on this re-issued bulletin is available at:
http://www.microsoft.com/technet/security/bulletin/MS03-051.asp
Today, 10 February 2004 Microsoft is releasing three new security bulletins.
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity rating of Critical
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity rating of Important
- One Microsoft Security Bulletin affecting Microsoft Virtual PC for the Macintosh with a maximum severity rating of Important
Summaries for the bulletins released today may be found at the following pages:
- Microsoft Windows
http://www.microsoft.com/technet/security/bulletin/winfeb04.asp
- Microsoft Virtual PC for the Macintosh
http://www.microsoft.com/technet/security/bulletin/macfeb04.asp
In addition one bulletin has been re-issued, MS03-051, affecting Microsoft FrontPage Server Extensions. Information on the re-issued bulletin may be found at:
- http://www.microsoft.com/technet/security/bulletin/MS03-051.asp
Please also see below for each of the individual Microsoft Security Bulletins listed above in the summaries.
Microsoft will also be hosting a webcast tomorrow to address customer questions on these bulletins. For more information on this webcast please see below:
Information about Microsoft's February Security Bulletins
11 February 2004 10:00 AM - 2/11/2004 11:00 AM PST
- http://go.microsoft.com/fwlink/?LinkId=22796
The on-demand version of the webcast will be available 24 hours after the live webcast at:
- http://go.microsoft.com/fwlink/?LinkId=22796
**********************************************************************
TECHNICAL DETAILS
MS04-005
Title: Vulnerability in Virtual PC could lead to privilege elevation
Affected Software:
Microsoft Virtual PC for the Macintosh 6.0 Microsoft Virtual PC for the Macintosh 6.01 Microsoft Virtual PC for the Macintosh 6.02 Microsoft Virtual PC for the Macintosh 6.1
Impact of Vulnerability: Local elevation of Privilege
Maximum Severity Rating: Important
Restart required: No
Update can be uninstalled: No
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-005.asp
**********************************************************************
MS04-006
Title: Vulnerability in the Windows Internet Naming Service (WINS) Could Allow Code Execution
Affected Software:
Microsoft Windows NT Workstation 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Windows XP 64-Bit Edition Version 2003
Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1
Microsoft Windows Server 2003
Microsoft Windows Server 2003 64-Bit
Edition Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Important
Restart required: Yes
Update can be uninstalled: Yes
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-006.asp
**********************************************************************
MS04-007
Title: ASN .1 Vulnerability Could Allow Code Execution
Affected Software:
Microsoft Windows NT Workstation 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Service Pack 6a
Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Windows XP 64-Bit Edition Version 2003
Microsoft Windows XP 64-Bit Edition Version 2003 Service Pack 1
Microsoft Windows Server 2003
Microsoft Windows Server 2003 64-Bit
Edition Affected Components:
Microsoft ASN.1 Library
Impact of Vulnerability: Remote Code Execution
Maximum Severity Rating: Critical
Restart required: Yes
Update can be uninstalled: Yes
More information on this vulnerability is available at:
http://www.microsoft.com/technet/security/bulletin/MS04-007.asp
**********************************************************************
MS03-051
Title: Buffer Overrun in Microsoft FrontPage Server Extensions Could Allow Code Execution
Affected Software:
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP 64-Bit Edition Service Pack 1
Microsoft Office XP
Microsoft Office XP Service Pack 1
Microsoft Office XP Service Pack 2
Affected Components:
Microsoft FrontPage Server Extensions 2000 (For Windows NT4) and Microsoft Office 2000 Server Extensions (Shipped with Office 2000
Microsoft FrontPage Server Extensions 2000 (Shipped with Windows 2000)
Microsoft FrontPage Server Extensions 2000 (Shipped with Windows XP)
Microsoft FrontPage Server Extensions 2002
Microsoft SharePoint Team Services 2002 (Shipped with Office XP)
Reason for Re-issue: Subsequent to the release of this bulletin, it was found that the vulnerability discussed in MS03-051 affects additional versions of the affected products and components. Specifically, it has been found to also affect Microsoft Windows XP 64-Bit Edition, Microsoft Windows XP 64-Bit Edition Service Pack 1, and Microsoft Office 2000 Server Extensions. Microsoft has updated the bulletin with additional information and posted security updates for these versions.
Customers should review the updated security bulletin to determine if they use any of the additionally affected versions of the affected product and components and apply the security update if they do. Customers who do not use any of the additionally affected versions of the affected product and components but applied the previously released security updates do not need to take any action.
More information on this re-issued bulletin is available at:
http://www.microsoft.com/technet/security/bulletin/MS03-051.asp
