Security Alerts
June 14, 2005
Microsoft Releases Patches for Multiple Critical Vulnerabilities
Summary
On Jun 14, 2005, Microsoft released ten new security updates, three of them rated as critical. All current versions of Windows are affected by some of them.
Some of these vulnerabilities can result in system-level compromise without direct user interaction. Others can result in compromise if the user opens a maliciously constructed HTML email message or web page.
What to Do
Windows users can manually use "Windows Update" to download and install the current operating system patches.
Additionally, it is recommended that all Windows machines have an automated patch management solution installed and configured on their system. Stanford provides BigFix to automatically patch Windows machines; it is available at http://patching.stanford.edu. Alternatively, Windows Automatic Update should be enabled.
Technical Detail
Information regarding all ten security updates is available at http://www.microsoft.com/technet/security/bulletin/ms05-jun.mspx. The following are brief summaries of those rated as critical.
MS05-025 - Cumulative Security Update for Internet Explorer (KB883939)
- Affected platforms:
- Windows 98, 98SE, ME
- Windows 2000, all versions
- Windows XP, all versions
- Windows Server 2003, all versions
- Activated by opening a malicious web page.
- No public exploit known at this time.
MS05-026 - Vulnerability in HTML Help Could Allow Remote Code Execution (KB896358)
- Affected platforms:
- Windows 98, 98SE, and ME
- Windows 2000, all versions
- Windows XP, all versions
- Windows Server 2003, all versions
- Activated by opening a malicious email message or web page.
- No public exploit known at this time.
MS05-027 - Vulnerability in Server Message Block Could Allow Remote Code Execution (KB896422)
- Affected platforms:
- Windows 2000, all versions
- Windows XP, all versions
- Windows Server 2003, all versions
- No credentials or user interaction required.
- No public exploit known at this time.
References
Additional information regarding these vulnerabilities is available at
The Information Security Office would like to thank the Windows Systems Team in ITSS for their assistance in producing this alert.