Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Microsoft Security Patches Stanch Windows, Exchange Flaws

Microsoft on Tuesday released three security bulletins that patched a quintet of vulnerabilities sprinkled among Windows, the Exchange e-mail server, and -- for the first time analysts could recall -- a third-party product.

Two of the three bulletins were tagged as "critical," including MS06-019, which patches a flaw in Exchange Server, and MS06-020, which involved the third-party product, Adobe's Flash Player.

"This [the Flash flaw] is the one that will be most disruptive to the most users," said Chris Andrew, vice president of security technologies at patch and vulnerability management developer PatchLink.

Windows XP SP1, Windows XP SP2, Windows 98, and Windows Millennium are bundled with a vulnerable version of Flash, said Microsoft in its alert, and users should update their copies immediately.

According to Microsoft, the Flash Player can be exploited by attackers armed with specially-crafted .swf (Flash animation files) using one of two different bugs. Either vulnerability can be used by hackers, most likely via silent drive-by downloads off malicious Web sites, to hijack PCs. In Microsoft's Internet Explorer, which is typically where Flash animations are rendered, Flash is an ActiveX control.

  • 1