-----BEGIN PGP SIGNED MESSAGE-----<br />Hash: SHA1<br /><br />********************************************************************<br />Title: Microsoft Security Bulletin Summary for February 2005<br />Issued: February, 2005<br />Version Number: 1.0<br />Bulletin:
http://go.microsoft.com/fwlink/?LinkId=42105<br />*******************************************************************<br /><br />Summary:<br />========<br />This advisory contains information about all security updates<br />released this month. It is broken down by security bulletin severity.<br /><br />Critical Security Bulletins<br />===========================<br /><br /> MS05-005 - Vulnerability in Office Could Allow Remote Code<br /> Execution (873352)<br /><br /> - Affected Software: <br /> - Microsoft Office XP Service Pack 2<br /> - Microsoft Office XP Service Pack 3 <br /> - Microsoft Project 2002<br /> - Microsoft Visio 2002<br /> - Microsoft Works Suite 2002<br /> - Microsoft Works Suite 2003<br /> - Microsoft Works Suite 2004<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0 <br /><br /> MS05-009 - Vulnerability in PNG Processing Could Allow Remote Code<br /> Execution (890261)<br /><br /> - Affected Software:<br /> - Microsoft Windows Media Player 9 Series<br /> - Microsoft Windows Messenger version 5.0 <br /> - MSN Messenger 6.1<br /> - MSN Messenger 6.2<br /><br /> - Affected Components:<br /> - Microsoft Windows Messenger 4.7.2009<br /> (when running on Windows XP Service Pack 1)<br /> - Microsoft Windows Messenger 4.7.3000<br /> (when running on Windows XP Service Pack 2)<br /><br /> - Review the FAQ section of bulletin MS05-009 for<br /> information about these operating systems:<br /> - Microsoft Windows 98<br /> - Microsoft Windows 98 Second Edition (SE)<br /> - Microsoft Windows Millennium Edition (ME)<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0 <br /> <br /> MS05-010 - Vulnerability in the License Logging Service Could<br /> allow Remote Code Execution (885834)<br /><br /> - Affected Software:<br /> - Microsoft Windows NT Server 4.0 Service Pack 6a<br /> - Microsoft Windows NT Server 4.0 Terminal Server<br /> Edition Service Pack 6a<br /> - Microsoft Windows 2000 Server Service Pack 3<br /> - Microsoft Windows 2000 Server Service Pack 4<br /> - Microsoft Windows 2003<br /> - Microsoft Windows 2003 for Itanium-based Systems<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br /> MS05-011 - Vulnerability in Server Message Block Could Allow <br /> Remote Code Execution (885250)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003 <br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based <br /> Systems<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br /> MS05-012 - Vulnerability in OLE and COM Could Allow Remote Code <br /> Execution (873333)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based<br /> Systems<br /><br /> - Review the FAQ section of bulletin MS05-012 for<br /> information about these operating systems:<br /> - Microsoft Windows 98<br /> - Microsoft Windows 98 Second Edition (SE)<br /> - Microsoft Windows Millennium Edition (ME)<br /><br /> - Microsoft Exchange 2000 Server Service Pack 3<br /> - Microsoft Exchange Server 2003<br /> - Microsoft Exchange Server 2003 Service Pack 1<br /> - Microsoft Exchange Server 5.0 Service Pack 2<br /> - Microsoft Exchange Server 5.5 Service Pack 4 <br /> - Microsoft Office XP Service Pack 3<br /> - Microsoft Office XP Service Pack 2<br /> - Microsoft Office 2003 Service Pack 1<br /> - Microsoft Office 2003<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br /> MS05-013 - Vulnerability in the DHTML Editing Component ActiveX<br /> Control Could Allow Remote Code Execution (891781)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based<br /> Systems<br /><br /> - Review the FAQ section of bulletin MS05-013 for<br /> information about these operating systems:<br /> - Microsoft Windows 98<br /> - Microsoft Windows 98 Second Edition (SE)<br /> - Microsoft Windows Millennium Edition (ME)<br /> <br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br /> MS05-014 - Cumulative Security Update for Internet Explorer<br /> (867282)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based<br /> Systems<br /><br /> - Review the FAQ section of bulletin MS05-014 for<br /> information about these operating systems:<br /> - Microsoft Windows 98<br /> - Microsoft Windows 98 Second Edition (SE)<br /> - Microsoft Windows Millennium Edition (ME)<br /><br /> - Affected Components:<br /> - Internet Explorer 5.01 Service Pack 3<br /> - Internet Explorer 5.01 Service Pack 4<br /> - Internet Explorer 5.5 Service Pack 2<br /> - Internet Explorer 6 Service Pack 1 <br /> - Internet Explorer 6 for Windows XP Service Pack 1<br /> (64-Bit Edition)<br /> - Internet Explorer 6 for Windows Server 2003<br /> - Internet Explorer 6 for Windows Server 2003 64-Bit<br /> Edition and Windows XP 64-Bit Edition Version 2003<br /> - Internet Explorer 6 for Windows XP Service Pack 2<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br /> MS05-015 - Vulnerability in Hyperlink Object Library Could Allow<br /> Remote Code Execution (888113)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based<br /> Systems<br /><br /> - Review the FAQ section of bulletin MS05-015 for<br /> information about these operating systems:<br /> - Microsoft Windows 98<br /> - Microsoft Windows 98 Second Edition (SE)<br /> - Microsoft Windows Millennium Edition (ME)<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br />Important Security Bulletins<br />============================<br /><br /> MS05-004 - Vulnerability in ASP.Net May Lead to Authentication <br /> Bypass (887219)<br /><br /> - Affected Software: <br /> - Microsoft .NET Framework 1.0<br /> - Microsoft .NET Framework 1.1<br /> <br /> - Impact: Information Disclosure, and possible<br /> Elevation of Privilege<br /> - Version Number: 1.0<br /> <br /> MS05-007 - Vulnerability in Windows Could Allow Information <br /> Disclosure (888302)<br /> <br /> - Affected Software:<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /><br /> - Impact: Information Disclosure<br /> - Version Number: 1.0<br /><br /> MS05-008 - Vulnerability in Windows Shell Could Allow Remote Code <br /> Execution (890047)<br /><br /> - Affected Software:<br /> - Microsoft Windows 2000 Service Pack 3<br /> - Microsoft Windows 2000 Service Pack 4<br /> - Microsoft Windows XP Service Pack 1<br /> - Microsoft Windows XP Service Pack 2<br /> - Microsoft Windows XP 64-Bit Edition Service Pack 1<br /> (Itanium)<br /> - Microsoft Windows XP 64-Bit Edition Version 2003<br /> (Itanium)<br /> - Microsoft Windows Server 2003<br /> - Microsoft Windows Server 2003 for Itanium-based<br /> Systems<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br />Moderate Security Bulletins<br />============================<br /><br /> MS05-006 - Vulnerability in Windows SharePoint Services and<br /> SharePoint Team Services Could Allow Cross-Site <br /> Scripting and Spoofing Attacks (887981)<br /><br /> - Affected Software:<br /> - Windows SharePoint Services for Windows Server 2003<br /> - SharePoint Team Services from Microsoft<br /><br /> - Impact: Remote Code Execution<br /> - Version Number: 1.0<br /><br />Update Availability:<br />===================<br />Updates are available to address these issues.<br />For additional information, including Technical Details,<br />Workarounds, answers to Frequently Asked Questions,<br />and Update Deployment Information please read<br />the Microsoft Security Bulletin Summary for this<br />month at:
http://go.microsoft.com/fwlink/?LinkId=42105<br /><br />Support:<br />========<br />Technical support is available from Microsoft Product Support<br />Services at 1-866-PC SAFETY (1-866-727-2338). There is no<br />charge for support calls associated with security updates.<br />International customers can get support from their local Microsoft<br />subsidiaries. Phone numbers for international support can be found<br />at:
http://support.microsoft.com/common/international.aspx<br /> <br />Additional Resources:<br />=====================<br />* Microsoft has created a free monthly e-mail newsletter containing<br /> valuable information to help you protect your network. This<br /> newsletter provides practical security tips, topical security<br /> guidance, useful resources and links, pointers to helpful<br /> community resources, and a forum for you to provide feedback<br /> and ask security-related questions.<br /> You can sign up for the newsletter at:<br /><br />
http://www.microsoft.com/technet/security/secnews/default.mspx<br /><br />* Microsoft has created a free e-mail notification service that<br /> serves as a supplement to the Security Notification Service<br /> (this e-mail). It provides timely notification of any minor<br /> changes or revisions to previously released Microsoft Security<br /> Bulletins. This new service provides notifications that are<br /> written for IT professionals and contain technical information<br /> about the revisions to security bulletins.<br /> Visit
http://www.microsoft.com to subscribe to this service:<br /><br /> - Click on Subscribe at the top of the page.<br /> - This will direct you via Passport to the Subscription center.<br /> - Under Newsletter Subscriptions you can sign up for the<br /> "Microsoft Security Notification Service: Comprehensive Version".<br /><br />* Join Microsoft's webcast for a live discussion of the technical<br /> details of these security bulletins and steps you can take<br /> to protect your environment. Details about the live webcast<br /> can be found at: <br /><br />
www.microsoft.com/technet/security/bulletin/summary.mspx<br /><br /> The on-demand version of the webcast will be available 24 hours<br /> after the live webcast at:<br /><br />
www.microsoft.com/technet/security/bulletin/summary.mspx<br /><br />* Protect your PC: Microsoft has provided information on how you<br /> can help protect your PC at the following locations:<br /><br />
http://www.microsoft.com/security/protect/<br /><br /> If you receive an e-mail that claims to be distributing a<br /> Microsoft security update, it is a hoax that may be distributing a<br /> virus. Microsoft does not distribute security updates through<br /> e-mail. You can learn more about Microsoft's software distribution<br /> policies here:<br /> <br />
http://www.microsoft.com/technet/security/topics/policy/swdist.mspx<br /><br />Acknowledgments:<br />================<br />Microsoft thanks the following for working with us to protect<br />customers:<br /><br />* Rafel Ivgi of Finjan (
http://www.finjan.com) for reporting an issue<br /> described in MS05-005.<br /><br />* Jean-Baptiste Marchand of Herve Schauer Consultants<br /> (
http://www.hsc.fr) for reporting an issue described in MS05-007.<br /><br />* Carlos Sarraute of Core Security Technologies <br /> (
http://www.corest.com) for reporting an issue described in <br /> MS05-009.<br /><br />* Kostya Kortchinsky (kostya.kortchinsky@renater.fr) of CERT RENATER<br /> for reporting an issue described in MS05-010.<br /><br />* eEye (
http://www.eeye.com) for reporting an issue described in <br /> MS05-012.<br /><br />* Michael Krax (
http://www.mikx.de) for working with us responsibly <br /> on an issue described in MS05-014.<br /><br />* Andreas Sandblad of Secunia (
http://www.secunia.com) for reporting<br /> an issue described in MS05-014.<br /><br />* Jouko Pynnönen (
http://jouko.iki.fi/index-en.html) for reporting an<br /> issue described in MS05-014.<br /><br />* Anna Hollingzworth (s53ur9ty_0x1ee1@yahoo.co.uk) for reporting an<br /> issue described in MS05-015.<br /><br />********************************************************************<br />THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS<br />PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT<br />DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING<br />THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR<br />PURPOSE.<br />IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE<br />LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,<br />INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL<br />DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN<br />ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.<br />SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY<br />FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING<br />LIMITATION MAY NOT APPLY.<br />********************************************************************<br /><br />-----BEGIN PGP SIGNATURE-----<br />Version: PGP 8.1<br /><br />iQIVAwUBQgkVU4reEgaqVbxmAQKmqg//dSGHXnBNjl/7E+NqVSzcweaPo2OI1Zrr<br />hQkSYmkR4Y5eMkwvZTYOVjg3b8t4EEPuQTVhxsZfZ+bCy1GQ/fjS5XY7T++KvaYF<br />fGLa/UtkktrkrMkctdgDVjlCvGP5xzz53CK2F0aKky/cI+Wa2FM/6pG3FZoCYiMx<br />r1DvDlnGxvCuitQnsgS3FG+3pUrYXQbOdE/mfoE/F8m1ymPHjwjoq3h/Q0lZKURY<br />A1Z5o5VxCowoO3JDXOlv93zLdgX2aQCX4Lj0C5RVEGkjYRDH7LK8dKNKpF2JpNDf<br />STBbVWVSLSpnHDExVsYHTs0yzIp2xKR328YU3W4QpYQ1HKa4W4+2GX9eCuHU4JNX<br />28dYFz/FO+nHz/KDdp88Hlk4XZ47j7b/tSKRAG27fUvY6p7qVdXAFD5qbh/E7Euy<br />8NURK5Y9QVDC3Ra110LOLhZfzQad19Rw7Z9JhcVIBAyaeLYa+rpJEzeU4O/Hgb6K<br />ypLbKq8bb0UbZyH2jIcjVYMSuMrfDDGq1xUHBgn98yPIXAGIyP7DTak+RO14f4/K<br />Ar3q5lvxkaZw1N+1s5FcHHPvg0Jv+Rk3CAveJoQxhkeB2VlBVRqS90OMlLjm2chw<br />kKnFPOCDfjgOMFK18gE/1cD7LKoaHvhNt+zVTuVjMwM+qXV+j02OZgFrh5elHp5+<br />bC6BzW1iQ5M=<br />=H9PZ<br />-----END PGP SIGNATURE-----<br />To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at the Microsoft.com web site <
http://www.microsoft.com/misc/unsubscribe.htm>. You can manage all your Microsoft.com communication preferences at this site.<br /><br />Legal Information <
http://www.microsoft.com/info/legalinfo/default.mspx>.<br /><br />This newsletter was sent by the Microsoft Corporation<br />1 Microsoft Way<br />Redmond, Washington, USA<br />98052
