…and leaving Outlook's default setting to open HTML emails in the Restricted Sites security zone would block the remote code execution threat.
Well, that sums up this month's critical security bulletins. Now, let's look at the three bulletins rated as important threats.
MS06-045
Microsoft Security Bulletin MS06-045, "Vulnerability in Windows Explorer Could Allow Remote Code Execution", fixes the Folder GUID Code Execution Vulnerability (CVE-2006-3281). While this is a publicly disclosed threat, there had been no reports of active exploits at the time of publishing.
This update affects Windows 2000 SP4, all versions of Windows XP, and all versions of Windows Server 2003. It's an important threat for all affected versions.
Firewall best practices would likely block an attack on this vector. By default, many programs open HTML emails in the Restricted Sites security zone. A workaround is to disable the Web Client service.
MS06-049
Microsoft Security Bulletin MS06-049, "Vulnerability in Windows Kernel Could Result in Elevation of Privilege", addresses the Windows 2000 Kernel Elevation of Privilege vulnerability (CVE-2006-3444). While this is a publicly disclosed threat, there had been no reports of active exploits at the time of publishing.
As the name implies, this important-rated threat is only an elevation of privilege threat, and it only affects Windows 2000. Valid log-on credentials are required to conduct an attack on this vector.
Microsoft reports no workarounds. This security bulletin replaces MS05-055.
MS06-050
Microsoft Security Bulletin MS06-050, "Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution", addresses two vulnerabilities: Hyperlink Object Buffer Overflow Vulnerability (CVE-2006-3086) and Hyperlink Object Function Vulnerability (CVE-2006-3438). While one of these is a publicly disclosed threat, no reports of active exploits had surfaced for either vulnerability at the time of publishing.
This update affects Windows 2000 SP4, all versions of Windows XP, and all versions of Windows Server 2003. It's an important threat for all affected versions. This security bulletin replaces MS05-015.
Final word
Well, that's definitely a lot of security patches for August. Looking on the bright side, many of them won't be of too much concern for a lot of managers.
In my experience, while Windows 2000 still sees heavy use in government, most corporate users have moved on, which eliminates some of the threats entirely. Using best practices will block some others, and there have been no reports of active exploits for any of the ones in this article.
John McCormick is a security consultant and well-known author in the field of IT, with more than 17,000 published articles. He has written the IT Locksmith column for TechRepublic for more than four years.
