Microsoft warns again on Windows

NEWS
Microsoft issued another slew of warnings about security holes on Wednesday, including a "critical" flaw that affects most Windows PCs. The most serious of the flaws involves DirectX, a library of graphics and multimedia programming instructions used by most PC games, and could allow malicious users to run code of their choice on a vulnerable PC. The flaw is unusually widespread, affecting all versions of DirectX from version 5.2 to the current 9.0a running on all versions of Windows from Windows 98 through the new Windows Server 2003, according to the Microsoft bulletin. The flaw, which received Microsoft's highest severity rating, involves the way DirectX handles MIDI music files. A malformed MIDI file could overrun the buffer in DirectX, at which point extra software embedded in the file would be executed. Exploiting the flaw would entail the creation of a maliciously malformed MIDI file, which vulnerable Windows users would have to be tricked into running, either through email or a Web page. "They'd have to come up with some way to get the user to click on that file," Stephen Toulouse of Microsoft's Security Response Centre said, noting that default security settings in recent versions of Microsoft Outlook email software and the Internet Explorer Web browser prevent the automatic launching of such files. Default security settings are even stronger in Windows Server 2003, Toulouse added, which is why the flaw has a lower rating of "important" for that operating system. Toulouse said there are no known exploits of the flaw, which was discovered by eEye Digital Security, but that affected Windows users should still apply the appropriate patch as soon as possible. Microsoft also announced the availability of a cumulative patch -- rated "important" -- that fixes new and previously reported vulnerabilities in the company's SQL Server software. A third bulletin warned of a "moderate" risk for a new method to launch a denial-of-service attack against a PC that runs the Windows NT 4.0 operating system. The latest alerts continue a busy month of security issues for the software giant. Mike Cherry, an analyst for research firm Directions on Microsoft, said the frequency of security alerts could be bad for Microsoft's image, particularly as they relate to Windows Server 2003, one of the first poster children for the company's "trustworthy computing" initiative. "There should be some concern that, even with the improved testing in that product, they're continuing to find these problems," he said. But no software maker can find every flaw before a product is released, Cherry said, and at least Microsoft is being upfront about potential problems. "They're getting much better about discussing these problems as they're found," he said. "We never would have gotten this kind of information three years ago."
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Talkback

Microsoft OS’s are used on PCs and servers throughout the world, and whether accepted or not MS are seen as representatives of America's overwhelming power in the world. Which, unfortunately, makes MS and its OS users a target for any malevolent individual or group with an actual or perceived grudge.

Therefore, it is somewhat incredible that when MS add extra features or applets to its operating systems it also leaves or adds gaping security holes in its products. This makes Microsoft vulnerable to any group that either wants to steal its ideas or compromise its products, while it’s customers are open to all sorts of on-line attacks.

It is obvious that MS should security test its applets and added features, by an independent company if necessary, before releasing them to users.

via Facebook 3 August, 2003 16:31
Reply

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

annonymous2

If Piratebay is a crime then so is borrowing a dvd you purchased to a family member or a friend. Why should we not be aloud to share. Most of the...

2 hours ago by annonymous2 on UK ISPs ordered to block Pirate Bay website
NanWag

File Services For Macintosh was causing Excel to prompt for Overwriting changes or Save Another Copy because it was changing the timestamp on the...

2 hours ago by NanWag on Windows Server 2008 drops the ball for Mac compatibility
Regis Machado

creative cloud $48/month in the USA, £48/month in the UK ($79). good for the competitors

4 hours ago by Regis Machado via Facebook on Adobe move promotes piracy
Tom Espiner

Hello KosGirl, Good question. I've asked Belfius for a response. The latest post I can find on Pastebin about it is here:...

4 hours ago by Tom Espiner on Hackers hold bank to ransom over stolen data
KosGirl

Have there been any further updates to this story? I can't find any information on whether the hackers released the data or not.

5 hours ago by KosGirl on Hackers hold bank to ransom over stolen data
SandJ

I have done 7 speed tests this morning on different speed test tools. They tell me my download speed is: 12.3, 12.3, 12.3, 11.1, 12.7, 12.7, 11.7...

6 hours ago by SandJ on Watchdog: TalkTalk's broadband speed test misled users
Jack Schofield

@Mary Microsoft could always send Mozilla a spec sheet and oblige them to meet the same standards as IE. Then Mozilla can spend millions of...

9 hours ago by Jack Schofield on Windows RT browsers and the point of Windows RT
goth1csnake3

Not before time, that people making films,dvd's get whats coming to them. Well done, Virgin Media.

11 hours ago by goth1csnake3 on Virgin Media: Spotify deal will bring down piracy
Simon Bisson and Mary Branscombe

Apex - the question then is what about letting the user choose to have a tablet where they don't have to have that responsibility? why can't the...

21 hours ago by Simon Bisson and Mary Branscombe on Windows RT browsers and the point of Windows RT
Simon Bisson and Mary Branscombe

Moley, Apex, thanks; I think there's an interesting other dimension of choice - the choice to have a platform that is 'locked down' in the sense...

21 hours ago by Simon Bisson and Mary Branscombe on Mozilla accuses Microsoft of shutting Firefox out of WOA
Yellowcave

Not surprised. I once used the methods to let my firewall just notify me of breaches. Not one single logged event was genuine. Once, we all...

1 day ago by Yellowcave on Mobile porn filters catch innocent content, says report
duplex

live realy sucks in facebook becuase people hack your profile

1 day ago by duplex on Irish watchdog: Facebook privacy still falls short
Ed Macnair

If only it was that simple. When you start accessing Cloud applications you are stuck with the security model the vendor provides...........unless...

1 day ago by Ed Macnair via Facebook on IT security? You're doing it wrong!
Phil at Cloud4

Another good updaet, I have enjoyed going on the journey reading this series on SharePoint 2010 and have learned alot. Great writing.

1 day ago by Phil at Cloud4 on Designing a SharePoint farm: Tiers before bedtime
muteen

roumers of an ipad Mini, isnt that just an iTouch!?

1 day ago by muteen on Apple rebrands iPad 4G as 'Wi-Fi + Cellular' for UK
apexwm

Thanks for this article and bringing this issue to light. Unfortunately this type of activity is common not only with Adobe, but many other...

1 day ago by apexwm on Adobe move promotes piracy
Andy Bolstridge

there's a very thin line between tax avoidance and tax efficiency - earning £850 a month and claiming dividends to bring my income up to normal...

1 day ago by Andy Bolstridge via Facebook on The Idle Self-employed
Andy Bolstridge

I see that they are happy to announce these numbers.. but no-one will take any notice until they start announcing sales numbers too.

1 day ago by Andy Bolstridge via Facebook on Microsoft's score card for Smoked by Windows Phone
AndyPagin

I saw a Windows phone about a year ago, haven't seen once since, and quite a few people own phones in the City of London.

1 day ago by AndyPagin on Microsoft's score card for Smoked by Windows Phone
helice041

Well said. You can add the change differences between US $ and Euro for the adobe cloud subscription and the very clouded informations about when...

2 days ago by helice041 on Adobe move promotes piracy