Sono stati rilasciati dei nuovi aggiornamenti di Windows. Si consiglia
\ndi tenere sempre aggiornate le proprie macchine.<\/p>\n
Saluti.
\nDomenica Quartarella
\nServizio Calcolo<\/p>\n
—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA1<\/p>\n
National Cyber Alert System<\/p>\n
Technical Cyber Security Alert TA06-129A<\/p>\n
Microsoft Windows and Exchange Server Vulnerabilities<\/p>\n
Original release date: May 9, 2006
\n Last revised: —
\n Source: US-CERT<\/p>\n
Systems Affected<\/p>\n
* Microsoft Windows
\n * Microsoft Exchange Server<\/p>\n
For more complete information, refer to the Microsoft Security
\n Bulletin Summary for May 2006.<\/p>\n
Overview<\/p>\n
Microsoft has released updates that address critical vulnerabilities
\n in Microsoft Windows and Exchange Server. Exploitation of these
\n vulnerabilities could allow a remote, unauthenticated attacker to
\n execute arbitrary code or cause a denial of service on a vulnerable
\n system.<\/p>\n
I. Description<\/p>\n
Microsoft Security Bulletin Summary for May 2006 addresses
\n vulnerabilities in Microsoft Windows and Exchange Server. Further
\n information is available in the following US-CERT Vulnerability Notes:<\/p>\n
VU#303452 – Microsoft Exchange fails to properly handle vCal and iCal
\n properties<\/p>\n
Microsoft Exchange Server does not properly handle the vCal and iCal
\n properties of email messages. Exploitation of this vulnerability may
\n allow a remote, unauthenticated attacker to execute arbitrary code on
\n an Exchange Server.
\n (CVE-2006-0027)<\/p>\n
VU#945060 – Adobe Flash products contain multiple vulnerabilities<\/p>\n
Several vulnerabilities in Adobe Macromedia Flash products may allow a
\n remote attacker to execute code on a vulnerable system.
\n (CVE-2006-0024)<\/p>\n
VU#146284 – Macromedia Flash Player fails to properly validate the
\n frame type identifier read from a “SWF” file<\/p>\n
A buffer overflow vulnerability in some versions of the Macromedia
\n Flash Player may allow a remote attacker to execute code on a
\n vulnerable system.
\n (CVE-2005-2628)<\/p>\n
II. Impact<\/p>\n
A remote, unauthenticated attacker could execute arbitrary code on a
\n vulnerable system. An attacker may also be able to cause a denial of
\n service.<\/p>\n
III. Solution<\/p>\n
Apply Updates<\/p>\n
Microsoft has provided updates for these vulnerabilities in the
\n Security Bulletins. Microsoft Windows updates are available on the
\n Microsoft Update site.<\/p>\n
Workarounds<\/p>\n
Please see the US-CERT Vulnerability Notes for workarounds.<\/p>\n
Appendix A. References<\/p>\n
* Microsoft Security Bulletin Summary for May 2006 – * Technical Cyber Security Alert TA06-075A – * US-CERT Vulnerability Note VU#303452 – * US-CERT Vulnerability Note VU#945060 – * US-CERT Vulnerability Note VU#146284 – * CVE-2006-0027 – * CVE-2006-0024 – * CVE-2005-2628 – * Microsoft Update – <update.microsoft.com\/microsoftupdate<\/a>><\/p>\n ____________________________________________________________________<\/p>\n The most recent version of this document can be found at:<\/p>\n <www.us-cert.gov\/cas\/techalerts\/TA06-129A.html<\/a>> Feedback can be directed to US-CERT Technical Staff. Please send For instructions on subscribing to or unsubscribing from this Produced 2006 by US-CERT, a government organization.<\/p>\n Terms of use:<\/p>\n
\n <www.microsoft.com\/technet\/security\/bulletin\/ms06-may.mspx<\/a>><\/p>\n
\n <www.us-cert.gov\/cas\/techalerts\/TA06-075A.html<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/303452<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/945060<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/146284<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-0027<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-0024<\/a>><\/p>\n
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2005-2628<\/a>><\/p>\n
\n ____________________________________________________________________<\/p>\n
\n email to <cert@cert.org<\/a>> with “TA06-129A Feedback VU#303452” in the
\n subject.
\n ____________________________________________________________________<\/p>\n
\n mailing list, visit <www.us-cert.gov\/cas\/signup.html<\/a>>.
\n ____________________________________________________________________<\/p>\n