CyberInsecure.com

Daily cyber threats and internet security news: network security, online safety and latest security alerts
March 11th, 2009

Monthly Microsoft Patch Fixes Critical Windows Kernel, WINS Vulnerabilities

Microsoft shipped yesterday three security bulletins with fixes for at least 8 documented vulnerabilities affecting Windows OS users.

The most serious is rated “critical” and could allow full remote execution attacks if a Windows user is simply lured into viewing a special image file.

The March 2009 bulletins include:

MS09-006: CVE-2009-0081, CVE-2009-0082, CVE-2009-0083 (CRITICAL) Multiple input validation vulnerabilities in the windows kernel allow random code execution though the GDI component (WMF and EMF files), and privilege escalations that allow random code to be run in kernel mode. These vulnerabilities affect all versions of Windows, including Vista and Windows Server 2008.  Microsoft expects to see exploit code for these flaws but reckons the reliability will be “inconsistent.” Replaces MS08-061.

MS09-007: CVE-2009-0085 (IMPORTANT): Secure Channel (SChannel) implements SSL and TLS. When using client certificates (X.509) the server implementation fails to properly validate that the client has access to the private key and allows impersonation using only knowledge of the public key of the client. The bulletin is available for all versions of Windows — Windows 2000 through Windows Server 2008. Replaces MS07-031.

MS09-008: CVE-2009-0093, CVE-2009-0094, CVE-2009-0233, CVE-2009-0234(IMPORTANT): Multiple vulnerabilities in the DNS and WINS server implementation. DNS spoofing is made easier by allowing a more predicable transaction ID, possible causing DNS cache poisoning. The update also fixes the problem with WPAD (Web Proxy Auto Discovery) described in security advisory 945713. A similar problem is fixed for WINS with the WPAD and ISATAP (IPv6: Intra Site Automatic Tunnel Addressing Protocol) names. Microsoft warns that “consistent exploit code” is likely. Replaces MS08-037, MS08-034 and MS08-066.

Due to “critical” nature of the bulletin, users should update their systems as soon as possible.

Share this item with others:

More on CyberInsecure:
  • Microsoft WINS Vulnerability Under Attack
  • Microsoft Patches Windows Worm And Drive-by Download Vulnerabilities
  • Oracle Patches Critical Database Vulnerabilities
  • Microsoft Patch 14 PowerPoint Vulnerabilities, Adobe Patch Reader And Acrobar 0-day Vulnerability
  • Microsoft Patches Critical Database And Office Flaws

    • Posted in Microsoft, Software, Vista, Vulnerabilities, Windows | Print This Post Print This Post

    This entry was posted on Wednesday, March 11th, 2009 at 1:08 am and is filed under Microsoft, Software, Vista, Vulnerabilities, Windows. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

    If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Monthly Microsoft Patch Fixes Critical Windows Kernel, WINS Vulnerabilities

    One Response to “Monthly Microsoft Patch Fixes Critical Windows Kernel, WINS Vulnerabilities”

    1. lennykaufman Says:
      March 11th, 2009 at 1:55 am

      There is apparently a problem with the patch for MS09-008, according to Security Vendor nCircle’s blog.

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    *
    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.

    « «
    » »