Microsoft yesterday released its monthly security updates, which on this “Patch Tuesday” included fixes for the Windows operating system and Internet Explorer (IE), MSN Messenger, Exchange Server and Word. The company designated five of the patches as critical and three as important.
Analyst Ed Moyle of Security Curve said its vital for Microsoft users to install the patches. The five critical vulnerabilities, which affect all but IE, involve remote code execution.
Remote Control
Remote code execution means that an attacker can remotely cause the system to execute any code he or she desires over the network, such as installing backdoors or Trojans.
“By far, the worst one is MS05-019, which is a vulnerability in the TCP/IP implementation of Windows; the fact that it is remotely exploitable, compounded by the fact that it affects the majority of Microsoft products, makes this one of the most serious vulnerabilities we’ve had in the past few years,” Moyle told TechNewsWorld.
“Given the amount of systems that are vulnerable, it is probably only a matter of time before we see malware such as a worm or virus that targets this vulnerability specifically,” he said.
Microsoft also stopped the automatic block it had put in place for enterprises that did not want to install Windows XP Service Pack 2 (SP2), a move it had scheduled when it first released the security update.
Enterprises can still manually block SP2 from installing on their desktops by turning off automatic updates, but this move would also block other security updates.
Saying No to SP2
Companies might want to block SP2 because its security functions can cause compatibility issues with existing software, which is why Microsoft offered the block when it released SP2 eight months ago.
The move was designed to give IT administrators time go develop workarounds to any application issues that arise.
But according to a survey released last week by AssetMetrix, fewer than 24 percent of 251 enterprise respondents had integrated SP2 into their desktop environments.
In addition, Microsoft added the ability to receive security bulletins via RSS feed or MSN Messenger alerts.
Loading ...
