Forum Home
Press F1
Thread ID: 35899	2003-07-25 01:30:00	Microsoft reveals another 'critical' flaw!	stu140103 (137)	Press F1

Post ID	Timestamp	Content	User
162669	2003-07-25 01:30:00	From ZDNet: -------------- Microsoft reveals another 'critical' flaw By David Becker, Special to ZDNet 24 July 2003 Microsoft issued another group of warnings about security holes Wednesday, including a "critical" flaw that affects most Windows PCs . The most serious of the flaws involves DirectX, a library of graphics and multimedia programming instructions used by most PC games, and could allow malicious users to run code of their choice on a vulnerable PC . The flaw is unusually widespread, affecting all versions of DirectX from version 5 . 2 to the current 9 . 0a running on all versions of Windows from Windows 98 through the new Windows Server 2003, according to the Microsoft bulletin . The flaw, which received Microsoft's highest severity rating, involves the way DirectX handles MIDI music files . A malformed MIDI file could overrun the buffer in DirectX, at which point extra software embedded in the file would be executed . Exploiting the flaw would entail the creation of a maliciously malformed MIDI file, which vulnerable Windows users would have to be tricked into running, either through e-mail or a Web page . "They'd have to come up with some way to get the user to click on that file," Stephen Toulouse of Microsoft's Security Response Center said, noting that default security settings in recent versions of Microsoft Outlook e-mail software and the Internet Explorer Web browser prevent the automatic launching of such files . Default security settings are even stronger in Windows Server 2003, Toulouse added, which is why the flaw has a lower rating of "important" for that operating system . Toulouse said there are no known exploits of the flaw, which was discovered by eEye Digital Security, but that affected Windows users should still apply the appropriate patch as soon as possible . Microsoft also announced the availability of a cumulative patch--rated "important"--that fixes new and previously reported vulnerabilities in the company's SQL Server software . A third bulletin warned of a "moderate" risk for a new method to launch a denial-of-service attack against a PC that runs the Windows NT 4 . 0 operating system . The latest alerts continue a busy month of security issues for the software giant . Mike Cherry, an analyst for research firm Directions on Microsoft, said the frequency of security alerts could be bad for Microsoft's image, particularly as they relate to Windows Server 2003, one of the first poster children for the company's "trustworthy computing" initiative . "There should be some concern that, even with the improved testing in that product, they're continuing to find these problems," he said . But no software maker can find every flaw before a product is released, Cherry said, and at least Microsoft is being upfront about potential problems . "They're getting much better about discussing these problems as they're found," he said . "We never would have gotten this kind of information three years ago . " ------------- It looks like we all will need to run windows Update this week :)	stu140103 (137)
162670	2003-07-25 01:49:00	don't forget directX 9b is now out. i don't think the redistributable is out yet tho. happy updateing.	tweak'e (174)
162671	2003-07-25 02:08:00	> happy updateing. Indeed yes. Went to Microsoft to get the update, pulled in Dxwebsetup - only 300 K - not so bad. but when you fire it up, it goes back to MS to get the update - 10 megs, dammit !!	TonyF (246)
162672	2003-07-25 02:10:00	Yes it is (download.microsoft.com)	-=JM=- (16)
1