Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[ISN] Microsoft patches three critical security problems
From: InfoSec News (isnc4i.org)
Date: Wed Nov 12 2003 - 06:16:19 CST
By Paul Roberts
IDG News Service
Microsoft released the second installment of its now monthly security
bulletins, patching three software holes in Windows systems that it
said were "critical" security risks and a fourth problem with
Microsoft Office that the company rated "important."
Taken together, the security holes could allow attackers to set up Web
pages to take advantage of vulnerable systems and read files or run
attack code on a remote user's Windows machine, Microsoft said.
One bulletin, MS03-049, affects Windows 2000 and Windows XP
workstations and fixes a critical buffer overrun vulnerability in a
Windows service called the Workstation Service, which manages requests
for files or printing services on a LAN. That service is turned "on"
by default in Windows and could be compromised by an attacker using an
improperly formatted network message that was sent to a vulnerable
A second bulletin, MS03-051, patches two critical problems that were
discovered in Microsoft's FrontPage Server Extensions, which are
installed by default with the Internet Information Services (IIS) on
certain versions of Windows 2000 and allows technical staff to create,
manage and add features to Web pages.
Microsoft said that it fixed a buffer overrun in the FrontPage Server
Extensions that could enable an attacker to place and run attack code
on a vulnerable machine, as well as a flaw in the way that a component
called SmartHTML interpreter works that made it vulnerable to
The Redmond, Wash., company also issued a new cumulative security
patch, MS03-048, for the Internet Explorer (IE) Web browser. The new
patch updates previous cumulative patches for IE and sews up five new
vulnerabilities in the product, including a problem with the browser's
cross domain security model, which governs how different Web sites
share information and interact with the Windows operating system.
The fourth patch, MS03-050, fixes a security hole in some versions of
Microsoft's Excel spreadsheet and Word word processing products that
could enable an attacker to embed an attack in a small program known
as a macro. Machines running vulnerable versions of those products
could have malicious code placed and run on their Windows system after
opening an infected spreadsheet or Word document, Microsoft said.
While all the security holes disclosed by Microsoft deserve prompt
attention from network administrators, the Workstation Service and
FrontPage Server Extensions vulnerabilities are particularly serious,
according to Vincent Gullotto, vice president of McAfee AVERT at
The problem with the Workstation Service that Microsoft identifies in
MS03-049 could be particularly troublesome for network administrators,
because it affects every Windows 2000 and Windows XP machine, rather
than less-plentiful servers, and because the vulnerability could allow
attackers to launch their attack without any user interaction,
MS03-051 is also dangerous, given the widespread use of Internet
Information Server and the ability of attackers to remotely exploit
the security hole and compromise vulnerable machines, he said.
Although Microsoft did not rate the Microsoft Office security hole
critical, that too could be an attractive target for attackers,
Attacks that use macros are less common than they used to be, he said.
However a vulnerability such as the one disclosed in MS03-050 that
allows remote code execution and the rich supply of systems running
affected versions of Microsoft Excel and Microsoft Word could prompt
hackers to write proof-of-concept code for the vulnerability that
could then be used in attacks, Gullotto said.
Microsoft only last month switched to a system of releasing monthly
security bulletins, replacing a system of weekly security updates.
The company made the change in response to complaints from Microsoft
customers about the difficulty of staying on top of the weekly
releases, Microsoft said.
Microsoft said it reserves the right to release bulletins at any time,
however, and will do so when it feels customers are in imminent danger
of being attacked because of a known software vulnerability.
ISN is currently hosted by Attrition.org
To unsubscribe email majordomoattrition.org with 'unsubscribe isn'
in the BODY of the mail.