Critical Microsoft Agent flaw hits Windows 2000
Summary: The most serious vulnerability covered in Microsoft's September patch batch is a remote code execution issue in the way Microsoft Agent handles certain specially crafted URLs.
It's a relatively light Patch Tuesday in Microsoft-land.
As expected, the software giant dropped four security bulletins (one was withdrawn at the last minute) with fixes for potentially serious holes in Windows, Visual Studio, Windows Services for UNIX, MSN Messenger and Windows Live Messenger.
The most serious vulnerability covered in this batch is a remote code execution issue in the way Microsoft Agent handles certain specially crafted URLs.
The bulletin (MS07-051) affects only Windows 2000. Because that version of the operating system is out of mainstream support, Microsoft only offers free patches for Windows 2000 SP4 (Service Pack 4).
Microsoft rates this as "critical" and warns:
The vulnerability could allow an attacker to remotely execute code on the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
The company is also urging Windows users to pay special attention to MS07-054, and "important" bulletin that includes patches for a code execution hole affecting MSN Messenger and Windows Live Messenger.
The flaw, which has already been publicly documented, could allow PC takeover attacks when a user accepts a webcam or video chat invitation from an attacker.
This update applies to MSN Messenger and Windows Live Messenger running on all versions of Windows (including Vista). Microsoft users running MSN Messenger 7.0.0820 or Windows Live Messenger 8.1 are not affected by this vulnerability.
[SEE: MSN Messenger vulnerable to ‘highly critical’ webcam flaw ]
A third remote code execution issue in Crystal Reports for Visual Studio is also addressed by the September patch batch. This update (MS07-052), rated "important," could allow arbitrary code injection attacks if a user is tricked into opening a booby-trapped RPT file. An attacker could exploit the vulnerability by sending an affected user a malformed RPT file as an e-mail attachment, or hosting the file on a malicious or compromised Web site.
The fourth update (MS07-053) applies to Windows Services for UNIX. This bulletin affects all versions of Windows (including Vista) and could allow an attacker to gain elevation of privilege.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Correction re: "mainstream support"
Whether an OS is out of mainstream support is irrelevant in this case -- XP is still in mainstream support but its free patches are only available for the latest service pack, just like 2000. It's based on how long that service pack had been available: in XP's case SP1 went out of support 24 months after SP2 was available; I believe it was something similar for 2000.
Is it really a W2K + Internet Explorer problem?
Since the only part of the operating system that "handles" specially crafted URLs is Internet Explorer, could it be that users of non-IE browsers are not at risk? I'd be curious to know.
In the workaround info, MS suggests turning off ActiveX
If you turn off auto-launching of Active-X controls or if you don't use IE, Outlook or Outlook Express, you're probably safe.
RE: Critical Microsoft Agent flaw hits Windows 2000
Just like always, prior Microsoft warez is 'bullet-proof' until a newer Microsoft warez is released.
Yes, and who knows better than Microsoft?
Naaaaah, they wouldn't do that, would they? Honest folks wouldn't stoop to such dirty tactics, y'think?
You're a nut.
RE: Critical Microsoft Agent flaw hits Windows 2000
http://www.astawerks.net
It's the last Microsoft system made
I'd sooner take my chances with hackers than with Microsoft. A hacker has to figure out how to hack a system, but Microsoft already knows. they created it, didn't they?
I'm using Windows 2000... but I'm clippy-free.
Why?
Because I don't use any Microsoft applications to view untrusted content.
And so far as I know I don't even use anything that uses Microsoft Agent in any
form. As near as I can tell, they're talking about *clippy* and his annoying friends.
Does ANYONE use that other than Office?
Web pages can use it
Amusing
Yawn