[ news_security_news ]
DHS: Patch Windows Now
David Utter
Staff Writer
2006-08-09
 Insider Reports RSS Feed
The importance of one Microsoft fix is so critical that the Department of Homeland Security is advising Windows users to apply it as soon as possible.
People who use Microsoft Windows and have Automatic Update running likely have the fix for MS06-040 in place. If not, the Department of Homeland Security suggests they apply that patch right now.
"This security patch is designed to protect against a vulnerability that, if exploited, could enable an attacker to remotely take control of an affected system and install programs, view, change, or delete data, and create new accounts with full user rights," the DHS Office of the Press Secretary said in a statement.
DHS advised that the U.S. Computer Emergency Readiness Team (US-CERT) is working with Microsoft to mitigate the threat associated with the vulnerability addressed by this patch. CERT provided some alarming details behind MS06-040:
A stack-based buffer overflow exists in the Microsoft Server service. If a remote attacker sends a specially crafted packet to a vulnerable Windows system, that attacker may be able to trigger the buffer overflow.
Note that we have received reports that this vulnerability is actively being exploited.
Malicious programmers wasted little time in pushing out exploits for this vulnerability. By creating them as quickly as possible, they hope to catch systems that have not been patched yet and access them. If those systems belong to a critical government agency, or a financial institution, an attacker could gather enough information to cause any number of problems.
Home users can visit http://update.microsoft.com/ to perform updates pending for their machines, if Automatic Update has not picked them up already. The site will check for existing patches, and is a good way to verify a system is up to date.
---
Tag: Windows
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
