[ news_security_news ]
Patched Microsoft Flaw Threatens Universal PnP
David Utter
Staff Writer
2007-04-10
 Security News RSS Feed
Users of Windows XP and other versions as designated in the latest advisory should apply a fix to a critical problem in Universal Plug and Play as soon as possible.
Patch Tuesday arrived from Microsoft bearing five bulletins on eight vulnerabilities in their products. Half of those vulnerabilities picked up the Critical label from Microsoft, meaning they posed possible remote code execution threats to unpatched systems.
One of the bulletins, MS07-019, referred to a condition that could have affected Windows Media Player 11 or other Windows components. The Universal Plug and Play library could be accessed by other applications or services, according to iDefense Labs.
The advisory notes from iDefense said exploitation of the problem would probably have been limited, even with the issue of remote code execution as a concern:
Due to various security mechanisms implemented in Windows XP SP2 and a variety of design choices, code execution may not be trivial even though this is a stack based buffer overflow. A combination of factors including a restriction on the total input size to the process and the HTTP interface's restriction of input to characters allowed by the protocol specification work together with system libraries compiled with the "/SAFESEH" option and stack cookies to make exploitation more difficult.
McAfee researcher and communications manager David Marcus said the Internet attack vector for a couple of other patched vulnerabilities were much more troubling:
"Of particular concern are CVE-2007-0938, the Microsoft Content Management Service Remote Code Execution Vulnerability of MS07-018 and MS07-021, and the MsgBox (CSRSS) Remote Code Execution Vulnerability. Both of these can result in remote code execution on affected systems.
Combined with the popularity of browser or Web-based attack vectors, these vulnerabilities can be particularly dangerous. Consumers and enterprises should take these vulnerabilities very seriously and employ a risk-based management approach to make sure they are properly protected."
---
Tags: Microsoft, Security, Bulletin, Patch Tuesday
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
