Si informano gli utenti dei sistemi operativi Windows che sono stati
\nrilasciati degli aggiornamenti critici sulla sicurezza.
\nSi invita pertanto a tenere aggiornato il proprio sistema operativo e ad
\neseguire periodicamente Windows Update.<\/p>\n
Domenica Quartarella
\nServizio Calcolo<\/p>\n
—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA1<\/p>\n
Technical Cyber Security Alert TA05-165A
\n Microsoft Windows and Internet Explorer Vulnerabilities<\/p>\n
Original release date: June 14, 2005
\n Last revised: —
\n Source: US-CERT<\/p>\n
Systems Affected<\/p>\n
* Microsoft Windows
\n * Microsoft Internet Explorer<\/p>\n
For more complete information, refer to the Microsoft Security
\n Bulletin Summary for June, 2005.<\/p>\n
Overview<\/p>\n
Microsoft has released updates that address critical vulnerabilities
\n in Windows and Internet Explorer. Exploitation of these
\n vulnerabilities could allow a remote, unauthenticated attacker to
\n execute arbitrary code or cause a denial of service.<\/p>\n
I. Description<\/p>\n
Microsoft Security Bulletins for June, 2005 address a number of
\n vulnerabilities in Windows, Internet Explorer, Outlook Express,
\n Outlook Web Access, ISA Server, the Step-by-Step Interactive Training
\n engine, and telnet. Further information about the more serious
\n vulnerabilities is available in the following Vulnerability Notes:<\/p>\n
VU#189754 – Microsoft Internet Explorer buffer overflow in PNG image
\n rendering component<\/p>\n
A buffer overflow in the PNG image rendering component of Microsoft
\n Internet Explorer may allow a remote attacker to execute code on a
\n vulnerable system.
\n (CAN-2005-1211)<\/p>\n
VU#489397 – Microsoft Server Message Block vulnerable to buffer
\n overflow<\/p>\n
Microsoft Server Message Block (SMB) is vulnerable to a buffer
\n handling flaw when processing incoming SMB packets that may lead to
\n remote code execution.
\n (CAN-2005-1206)<\/p>\n
VU#851869 – Microsoft HTML Help input validation error<\/p>\n
Microsoft HTML Help fails to properly validate input data, allowing a
\n remote attacker to execute arbitrary code.
\n (CAN-2005-1208)<\/p>\n
II. Impact<\/p>\n
Exploitation of the most serious of these vulnerabilities could allow
\n a remote, unauthenticated attacker to execute arbitrary code with
\n SYSTEM privileges. This would allow an attacker to take complete
\n control of a vulnerable system. An attacker could also execute
\n arbitrary code with user privileges, or cause a denial of service.<\/p>\n
III. Solution<\/p>\n
Apply updates<\/p>\n
Microsoft has provided the patches for these vulnerabilities in the
\n Security Bulletins and on Windows Update.<\/p>\n
Workarounds<\/p>\n
Please see the individual vulnerability notes for workarounds.<\/p>\n
Appendix A. References<\/p>\n
* Microsoft Security Bulletin Summary for June, 2005 – * US-CERT Vulnerability Note VU#189754 – * US-CERT Vulnerability Note VU#489397 – * US-CERT Vulnerability Note VU#851869 – * CAN-2005-1211 – * CAN-2005-1206 – * CAN-2005-1208 – * Microsoft Windows Update – <windowsupdate.microsoft.com\/<\/a>> Feedback can be directed to the US-CERT Technical Staff Revision History<\/p>\n June 14, 2005: Initial release This document is available from:<\/p>\n <www.us-cert.gov\/cas\/techalerts\/TA05-165A.html<\/a>><\/p>\n Produced 2005 by US-CERT, a government organization.<\/p>\n Terms of use<\/p>\n
\n <www.microsoft.com\/technet\/security\/bulletin\/ms05-jun.mspx<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/189754<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/489397<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/851869<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CAN-2005-1222<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CAN-2005-1206<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CAN-2005-1208<\/a>><\/p>\n
\n _________________________________________________________________<\/p>\n
\n _________________________________________________________________<\/p>\n
\n _________________________________________________________________<\/p>\n