Critical Windows Security Updates Released by Microsoft

Published: May 10, 2006

by Alex Woodie

Microsoft issued three patches yesterday--including two rated critical and one with a moderate rating--to fix security vulnerabilities in several of its products, including client and server versions of Windows and Exchange Server 2000 and 2003. Microsoft said it wasn't aware of any active attacks using any of the newly discovered problems. But that was yesterday, and the exploits are almost guaranteed to start arriving, so Windows shops should apply the patches as soon as possible.

Security Bulletin MS06-019 fixes a critical vulnerability in Exchange Server 2000 and Exchange Server 2003 Service Packs 1 and 2 (SP1 and SP2) that could allow an attacker to gain complete control over an affected system. The patch provides a fix for Exchange Calendar Vulnerability, a privately disclosed vulnerability that hackers can exploit by sending specially crafted iCal or vCal messages to an Exchange Server. Microsoft did not detect any active attacks, nor any "proof of concept" code utilizing this exploit on the Web. However, the damage potential of the Exchange Calendar Vulnerability--including the potential for a self-replicating worm--is quite high, which is why Microsoft gave it the critical rating.

This patch has known compatibility issues with two third-party products, including Research In Motion's Blackberry Enterprise Server and Good Technology's GoodLink Wireless Messaging systems. Users of these systems should consult Microsoft's Knowledge Base article 912918 for tips on how to overcome the ancillary problems introduced with this patch.

Security Bulletin MS06-020 fixes two critical vulnerabilities in Windows XP SP1 and SP2 and the Windows 98/SE/Me family of operating systems that could allow an attacker to execute their choice of code on affected systems. These vulnerabilities are closely tied to unchecked buffers in Adobe's popular Macromedia Flash player, which can provide hackers with full system access if a victim opens a maliciously constructed Flash Animation (SWF) file, either in a Web browser or as an e-mail attachment.

Microsoft became aware of the problems in the Flash player last fall, when it published a security advisory on the topic. Because Microsoft distributes the Macromedia Flash player with some versions of Windows, it addressed the vulnerability with its own patches.

Security Bulletin MS06-018 patches the least significant flaws, including a collection of three MSDTC vulnerabilities that carry the risk of denial of service (DOS) attacks for users of Windows 2000 SP4, Windows XP SP1 and SP2, the original release of Windows Server 2003, and the version of Windows Server 2003 for Itanium-based Systems. (Current operating systems not affected by this flaw include the SP1 releases of Windows Server 2003 for 32-bit and 64-bit Itanium systems, and the Windows Server 2003 for X64 Systems release that's based on the Server SP1 code.)

That's only half the story, however. Users who are still running older operating systems--including Windows NT Workstation 4.0 SP6a and Windows 2000 SP2 and SP3-beware. You are at risk of a DOS attack due to the MSDTC flaws, and Microsoft is not going to help you, unless you sign up for custom support (call it the "stick" part of Microsoft's "carrot and a stick" approach to dealing with its legacy problem). "It should be a priority for customers who have these operating system versions to migrate to supported versions to prevent potential exposure to vulnerabilities," Microsoft says in Security Bulletin MS06-018.

Microsoft also updated its Malicious Software Removal Tool with yesterday's update.