Ieri e` stato rilasciato un nuovo aggiornamento critico alla sicurezza
\nper i sistemi operativi Windows e i software Outlook e Exchange.
\nSi raccomanda di mantenere sempre aggiornati i propri sistemi.<\/p>\n
Domenica Quartarella
\nServizio Calcolo<\/p>\n
—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA1<\/p>\n
National Cyber Alert System<\/p>\n
Technical Cyber Security Alert TA06-010A<\/p>\n
Microsoft Windows, Outlook, and Exchange Vulnerabilities<\/p>\n
Original release date: January 10, 2006
\n Last revised: January 10, 2006
\n Source: US-CERT<\/p>\n
Systems Affected<\/p>\n
* Microsoft Windows
\n * Microsoft Outlook
\n * Microsoft Exchange<\/p>\n
For more complete information, refer to the Microsoft Security
\n Bulletin Summary for January 2006.<\/p>\n
Overview<\/p>\n
Microsoft has released updates that address critical vulnerabilities
\n in Windows, Outlook, and Exchange. Exploitation of these
\n vulnerabilities could allow a remote, unauthenticated attacker to
\n execute arbitrary code or cause a denial of service on a vulnerable
\n system.<\/p>\n
I. Description<\/p>\n
Microsoft Security Bulletins for January 2006 address vulnerabilities
\n in Microsoft Windows, Outlook, and Exchange. Further information is
\n available in the following US-CERT Vulnerability Notes:<\/p>\n
VU#915930 – Microsoft embedded web font buffer overflow<\/p>\n
A heap-based buffer overflow in the way Microsoft Windows processes
\n embedded web fonts may allow a remote, unauthenticated attacker to
\n execute arbitrary code on a vulnerable system.
\n (CVE-2006-0010)<\/p>\n
VU#252146 – Microsoft Outlook and Microsoft Exchange TNEF decoding
\n vulnerability<\/p>\n
Microsoft Outlook and Microsoft Exchange contain an unspecified
\n vulnerability in processing TNEF attachments. This may allow a remote,
\n unauthenticated attacker to execute arbitrary code on a system running
\n the vulnerable software.
\n (CVE-2006-0002)<\/p>\n
II. Impact<\/p>\n
Exploitation of these vulnerabilities may allow a remote,
\n unauthenticated attacker to execute arbitrary code with the privileges
\n of the user. If the user is logged on with administrative privileges,
\n the attacker could take complete control of an affected system. An
\n attacker may also be able to cause a denial of service.<\/p>\n
III. Solution<\/p>\n
Apply Updates<\/p>\n
Microsoft has provided the updates for these vulnerabilities in the
\n Security Bulletins and on the Microsoft Update site.<\/p>\n
Workarounds<\/p>\n
Please see the US-CERT Vulnerability Notes in Appendix A for
\nworkarounds.<\/p>\n
Appendix A. References<\/p>\n
* Microsoft Security Bulletin Summary for January 2006 – * US-CERT Vulnerability Note VU#915930 – * US-CERT Vulnerability Note VU#252146 – * CVE-2006-0002 – * CAN-2006-0010 – * Microsoft Update – <update.microsoft.com\/microsoftupdate<\/a>><\/p>\n ____________________________________________________________________<\/p>\n The most recent version of this document can be found at:<\/p>\n <www.us-cert.gov\/cas\/techalerts\/TA06-010A.html<\/a>> Feedback can be directed to US-CERT Technical Staff. Please send For instructions on subscribing to or unsubscribing from this Produced 2006 by US-CERT, a government organization.<\/p>\n Terms of use:<\/p>\n
\n <www.microsoft.com\/technet\/security\/bulletin\/ms06-jan.mspx<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/915930<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/252146<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-0002<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-0010<\/a>><\/p>\n
\n ____________________________________________________________________<\/p>\n
\n email to <cert@cert.org<\/a>> with “TA06-010A Feedback VU#915930” in the
\n subject.
\n ____________________________________________________________________<\/p>\n
\n mailing list, visit <www.us-cert.gov\/cas\/signup.html<\/a>>.
\n ____________________________________________________________________<\/p>\n