This month's round of fixes from Microsoft demonstrated once again that its new approach to trapping bugs and possible exploits, which it adopted for Microsoft Office 2007 and Windows Vista — the Software Development Lifecycle — continues to pay off.
@36271 It still doesn't mean total immunity, though -- few potential security exploits for Internet Explorer 7 under Windows Vista and a few Microsoft Office 2007 products have surfaced. But the vast majority of the problems this time around are confined to earlier Microsoft products.
Although not everyone is affected equally by these problems, all of the patches have been rated as critical.
- Five exploits have been discovered that affect Internet Explorer, with four of the five affecting Internet Explorer 7 under Windows Vista. The Uninitialized Memory Corruption Vulnerability problem that's addressed in this bulletin affects only Internet Explorer 6 or earlier, but don't take this as a sign that Internet Explorer 7 should not be patched.
- A set of vulnerabilities that affects all of Microsoft Office is affecting some Microsoft Office 2007 products, although there's a Microsoft Word issue that affects only versions of Microsoft Word before 2007. Versions of Microsoft Works and Microsoft Word for the Macintosh are also affected.
- A set of issues that affect Microsoft Exchange Server 2000 through 2007 is also being addressed, although two of the four issues don't affect Microsoft Exchange Server 2007 -- probably because of better programming practices.
- An issue in the Cryptographic API has been dealt with, although the only major software affected by this is BizTalk 2004, and the conditions for the exploit are fairly rare.
- Finally, Microsoft has finally fixed a problem with a vulnerability in Windows DNS Server's RPC system on Windows 2000 Server and Windows Server 2003. This issue made it possible to attack and take control of the Microsoft DNS service via the RPC remote-management function for DNS. Word about this has been circulating for some time, and a common workaround was to simply disable remote management via RPC for DNS through a Registry edit. If you edited the Registry as a workaround, those changes will not be undone when you apply this fix. You'll need to undo them yourself manually.
About the author: Serdar Yegulalp is editor of Windows Insight. Check it out for the latest advice and musings on the world of Windows network administrators -- and please share your thoughts as well!