"Because that version of the operating system is out of mainstream support, Microsoft only offers free patches for Windows 2000 SP4 (Service Pack 4)."
Whether an OS is out of mainstream support is irrelevant in this case -- XP is still in mainstream support but its free patches are only available for the latest service pack, just like 2000. It's based on how long that service pack had been available: in XP's case SP1 went out of support 24 months after SP2 was available; I believe it was something similar for 2000.
It’s a relatively light Patch Tuesday in Microsoft-land.
As expected, the software giant dropped four security bulletins (one was withdrawn at the last minute) with fixes for potentially serious holes in Windows, Visual Studio, Windows Services for UNIX, MSN Messenger and Windows Live Messenger.
The most serious vulnerability covered in this batch is a remote code execution issue in the way Microsoft Agent handles certain specially crafted URLs.
The bulletin (MS07-051) affects only Windows 2000. Because that version of the operating system is out of mainstream support, Microsoft only offers free patches for Windows 2000 SP4 (Service Pack 4).
Microsoft rates this as “critical” and warns:
The vulnerability could allow an attacker to remotely execute code on the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
The company is also urging Windows users to pay special attention to MS07-054, and “important” bulletin that includes patches for a code execution hole affecting MSN Messenger and Windows Live Messenger.
The flaw, which has already been publicly documented, could allow PC takeover attacks when a user accepts a webcam or video chat invitation from an attacker.
This update applies to MSN Messenger and Windows Live Messenger running on all versions of Windows (including Vista). Microsoft users running MSN Messenger 7.0.0820 or Windows Live Messenger 8.1 are not affected by this vulnerability.
[SEE: MSN Messenger vulnerable to ‘highly critical’ webcam flaw ]
A third remote code execution issue in Crystal Reports for Visual Studio is also addressed by the September patch batch. This update (MS07-052), rated “important,” could allow arbitrary code injection attacks if a user is tricked into opening a booby-trapped RPT file. An attacker could exploit the vulnerability by sending an affected user a malformed RPT file as an e-mail attachment, or hosting the file on a malicious or compromised Web site.
The fourth update (MS07-053) applies to Windows Services for UNIX. This bulletin affects all versions of Windows (including Vista) and could allow an attacker to gain elevation of privilege.
