[CTS] FW: Microsoft Security Bulletin Summary for February 2005
- From: "Eric C. Vogel" <ecvogel@xxxxxxxxx>
- To: <computertalkshop@xxxxxxxxxxxxx>
- Date: Tue, 8 Feb 2005 20:09:31 -0500
They had to wait till after I left work. Sesh!
-----Original Message-----
From: Microsoft
[mailto:20_9655_EimKYaEk5InOZWsE/dr0SA@xxxxxxxxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, February 08, 2005 6:40 PM
To: ecvogel@xxxxxxxxx
Subject: Microsoft Security Bulletin Summary for February 2005
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
********************************************************************
Title: Microsoft Security Bulletin Summary for February 2005
Issued: February, 2005
Version Number: 1.0
Bulletin: http://go.microsoft.com/fwlink/?LinkId=42105
*******************************************************************
Summary:
========
This advisory contains information about all security updates released this
month. It is broken down by security bulletin severity.
Critical Security Bulletins
===========================
MS05-005 - Vulnerability in Office Could Allow Remote Code
Execution (873352)
- Affected Software:
- Microsoft Office XP Service Pack 2
- Microsoft Office XP Service Pack 3
- Microsoft Project 2002
- Microsoft Visio 2002
- Microsoft Works Suite 2002
- Microsoft Works Suite 2003
- Microsoft Works Suite 2004
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-009 - Vulnerability in PNG Processing Could Allow Remote Code
Execution (890261)
- Affected Software:
- Microsoft Windows Media Player 9 Series
- Microsoft Windows Messenger version 5.0
- MSN Messenger 6.1
- MSN Messenger 6.2
- Affected Components:
- Microsoft Windows Messenger 4.7.2009
(when running on Windows XP Service Pack 1)
- Microsoft Windows Messenger 4.7.3000
(when running on Windows XP Service Pack 2)
- Review the FAQ section of bulletin MS05-009 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-010 - Vulnerability in the License Logging Service Could
allow Remote Code Execution (885834)
- Affected Software:
- Microsoft Windows NT Server 4.0 Service Pack 6a
- Microsoft Windows NT Server 4.0 Terminal Server
Edition Service Pack 6a
- Microsoft Windows 2000 Server Service Pack 3
- Microsoft Windows 2000 Server Service Pack 4
- Microsoft Windows 2003
- Microsoft Windows 2003 for Itanium-based Systems
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-011 - Vulnerability in Server Message Block Could Allow
Remote Code Execution (885250)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-012 - Vulnerability in OLE and COM Could Allow Remote Code
Execution (873333)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Review the FAQ section of bulletin MS05-012 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Microsoft Exchange 2000 Server Service Pack 3
- Microsoft Exchange Server 2003
- Microsoft Exchange Server 2003 Service Pack 1
- Microsoft Exchange Server 5.0 Service Pack 2
- Microsoft Exchange Server 5.5 Service Pack 4
- Microsoft Office XP Service Pack 3
- Microsoft Office XP Service Pack 2
- Microsoft Office 2003 Service Pack 1
- Microsoft Office 2003
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-013 - Vulnerability in the DHTML Editing Component ActiveX
Control Could Allow Remote Code Execution (891781)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Review the FAQ section of bulletin MS05-013 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-014 - Cumulative Security Update for Internet Explorer
(867282)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Review the FAQ section of bulletin MS05-014 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Affected Components:
- Internet Explorer 5.01 Service Pack 3
- Internet Explorer 5.01 Service Pack 4
- Internet Explorer 5.5 Service Pack 2
- Internet Explorer 6 Service Pack 1
- Internet Explorer 6 for Windows XP Service Pack 1
(64-Bit Edition)
- Internet Explorer 6 for Windows Server 2003
- Internet Explorer 6 for Windows Server 2003 64-Bit
Edition and Windows XP 64-Bit Edition Version 2003
- Internet Explorer 6 for Windows XP Service Pack 2
- Impact: Remote Code Execution
- Version Number: 1.0
MS05-015 - Vulnerability in Hyperlink Object Library Could Allow
Remote Code Execution (888113)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Review the FAQ section of bulletin MS05-015 for
information about these operating systems:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition (SE)
- Microsoft Windows Millennium Edition (ME)
- Impact: Remote Code Execution
- Version Number: 1.0
Important Security Bulletins
============================
MS05-004 - Vulnerability in ASP.Net May Lead to Authentication
Bypass (887219)
- Affected Software:
- Microsoft .NET Framework 1.0
- Microsoft .NET Framework 1.1
- Impact: Information Disclosure, and possible
Elevation of Privilege
- Version Number: 1.0
MS05-007 - Vulnerability in Windows Could Allow Information
Disclosure (888302)
- Affected Software:
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Impact: Information Disclosure
- Version Number: 1.0
MS05-008 - Vulnerability in Windows Shell Could Allow Remote Code
Execution (890047)
- Affected Software:
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP 64-Bit Edition Service Pack 1
(Itanium)
- Microsoft Windows XP 64-Bit Edition Version 2003
(Itanium)
- Microsoft Windows Server 2003
- Microsoft Windows Server 2003 for Itanium-based
Systems
- Impact: Remote Code Execution
- Version Number: 1.0
Moderate Security Bulletins
============================
MS05-006 - Vulnerability in Windows SharePoint Services and
SharePoint Team Services Could Allow Cross-Site
Scripting and Spoofing Attacks (887981)
- Affected Software:
- Windows SharePoint Services for Windows Server 2003
- SharePoint Team Services from Microsoft
- Impact: Remote Code Execution
- Version Number: 1.0
Update Availability:
===================
Updates are available to address these issues.
For additional information, including Technical Details, Workarounds,
answers to Frequently Asked Questions, and Update Deployment Information
please read the Microsoft Security Bulletin Summary for this month at:
http://go.microsoft.com/fwlink/?LinkId=42105
Support:
========
Technical support is available from Microsoft Product Support Services at
1-866-PC SAFETY (1-866-727-2338). There is no charge for support calls
associated with security updates.
International customers can get support from their local Microsoft
subsidiaries. Phone numbers for international support can be found
at: http://support.microsoft.com/common/international.aspx
Additional Resources:
=====================
* Microsoft has created a free monthly e-mail newsletter containing
valuable information to help you protect your network. This
newsletter provides practical security tips, topical security
guidance, useful resources and links, pointers to helpful
community resources, and a forum for you to provide feedback
and ask security-related questions.
You can sign up for the newsletter at:
http://www.microsoft.com/technet/security/secnews/default.mspx
* Microsoft has created a free e-mail notification service that
serves as a supplement to the Security Notification Service
(this e-mail). It provides timely notification of any minor
changes or revisions to previously released Microsoft Security
Bulletins. This new service provides notifications that are
written for IT professionals and contain technical information
about the revisions to security bulletins.
Visit http://www.microsoft.com to subscribe to this service:
- Click on Subscribe at the top of the page.
- This will direct you via Passport to the Subscription center.
- Under Newsletter Subscriptions you can sign up for the
"Microsoft Security Notification Service: Comprehensive Version".
* Join Microsoft's webcast for a live discussion of the technical
details of these security bulletins and steps you can take
to protect your environment. Details about the live webcast
can be found at:
www.microsoft.com/technet/security/bulletin/summary.mspx
The on-demand version of the webcast will be available 24 hours
after the live webcast at:
www.microsoft.com/technet/security/bulletin/summary.mspx
* Protect your PC: Microsoft has provided information on how you
can help protect your PC at the following locations:
http://www.microsoft.com/security/protect/
If you receive an e-mail that claims to be distributing a
Microsoft security update, it is a hoax that may be distributing a
virus. Microsoft does not distribute security updates through
e-mail. You can learn more about Microsoft's software distribution
policies here:
http://www.microsoft.com/technet/security/topics/policy/swdist.mspx
Acknowledgments:
================
Microsoft thanks the following for working with us to protect
customers:
* Rafel Ivgi of Finjan (http://www.finjan.com) for reporting an issue
described in MS05-005.
* Jean-Baptiste Marchand of Herve Schauer Consultants
(http://www.hsc.fr) for reporting an issue described in MS05-007.
* Carlos Sarraute of Core Security Technologies
(http://www.corest.com) for reporting an issue described in
MS05-009.
* Kostya Kortchinsky (kostya.kortchinsky@xxxxxxxxxx) of CERT RENATER
for reporting an issue described in MS05-010.
* eEye (http://www.eeye.com) for reporting an issue described in
MS05-012.
* Michael Krax (http://www.mikx.de) for working with us responsibly
on an issue described in MS05-014.
* Andreas Sandblad of Secunia (http://www.secunia.com) for reporting
an issue described in MS05-014.
* Jouko Pynnönen (http://jouko.iki.fi/index-en.html) for reporting an
issue described in MS05-014.
* Anna Hollingzworth (s53ur9ty_0x1ee1@xxxxxxxxxxx) for reporting an
issue described in MS05-015.
********************************************************************
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"
WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER
EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE.
IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT
APPLY.
********************************************************************
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQIVAwUBQgkVU4reEgaqVbxmAQKmqg//dSGHXnBNjl/7E+NqVSzcweaPo2OI1Zrr
hQkSYmkR4Y5eMkwvZTYOVjg3b8t4EEPuQTVhxsZfZ+bCy1GQ/fjS5XY7T++KvaYF
fGLa/UtkktrkrMkctdgDVjlCvGP5xzz53CK2F0aKky/cI+Wa2FM/6pG3FZoCYiMx
r1DvDlnGxvCuitQnsgS3FG+3pUrYXQbOdE/mfoE/F8m1ymPHjwjoq3h/Q0lZKURY
A1Z5o5VxCowoO3JDXOlv93zLdgX2aQCX4Lj0C5RVEGkjYRDH7LK8dKNKpF2JpNDf
STBbVWVSLSpnHDExVsYHTs0yzIp2xKR328YU3W4QpYQ1HKa4W4+2GX9eCuHU4JNX
28dYFz/FO+nHz/KDdp88Hlk4XZ47j7b/tSKRAG27fUvY6p7qVdXAFD5qbh/E7Euy
8NURK5Y9QVDC3Ra110LOLhZfzQad19Rw7Z9JhcVIBAyaeLYa+rpJEzeU4O/Hgb6K
ypLbKq8bb0UbZyH2jIcjVYMSuMrfDDGq1xUHBgn98yPIXAGIyP7DTak+RO14f4/K
Ar3q5lvxkaZw1N+1s5FcHHPvg0Jv+Rk3CAveJoQxhkeB2VlBVRqS90OMlLjm2chw
kKnFPOCDfjgOMFK18gE/1cD7LKoaHvhNt+zVTuVjMwM+qXV+j02OZgFrh5elHp5+
bC6BzW1iQ5M=
=H9PZ
-----END PGP SIGNATURE-----
To cancel your subscription to this newsletter, reply to this message with
the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at the
Microsoft.com web site <http://www.microsoft.com/misc/unsubscribe.htm>. You
can manage all your Microsoft.com communication preferences at this site.
Legal Information <http://www.microsoft.com/info/legalinfo/default.mspx>.
This newsletter was sent by the Microsoft Corporation
1 Microsoft Way
Redmond, Washington, USA
98052
---------------------------------------------------------------------------
Computer Talk Shop http://www.computertalkshop.com
Un-subscribe/Vacation, http://www.computertalkshop.com/list_options.htm
List HowTo: http://www.computertalkshop.com/faq.htm
To join Computer Talk Shop's off topic list, please goto:
http://computertalkshop.com/other_cts_lists.htm
---------------------------------------------------------------------------
Other related posts:
