As Promised: Microsoft’s 5 Windows Security Updates   12/15/2004 - 1,221 views, 1 Comment

As Aunty promised, here is the rundown on the five… count ‘em… five security updates which Microsoft just released for Windows users and administrators:

1. Vulnerability in WordPad

According to the Microsoft site, the vulnerabilty in WordPad allows an attacker to “take complete control of the affected system”. Ouch. There are actually two vulnerabilities in WordPad which allow this, says Microsoft. The “Table Conversion Vulnerability” and the “Font Conversion Vulnerability”.

Various version of Windows NT, 2000, XP, and Windows Server are affected by this vulnerability.

[Note that the links to the full information and security updates appear at the end of this post.]

2. Vulnerability in the Windows Kernal

This is actually a suite of vulnerabilities, if you will, which affects Windows XP, NT, 2000, and Windows Server.

The attacker who exploits these vulnerabilities can have their wicked way with your system, including, says Microsoft, “installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges.” Yum!

3. Vulnerability in HyperTerminal

This vulnerability affects…wait for it… XP, NT, 2000, and Windows Server (are you detecting a theme here?)

As with the other vulnerabilities reported above, if someone is able to exploit the HyperTerminal vulnerability, they can take complete control of the system, and create or delete accounts, install programs, etc.. Not a pretty sight.

4. Vulnerability in DHCP

Unlike the above three vulnerabilities, which affect all installations of the affected Windows versions, this vulnerability only affects users who use the Windows DHCP Server service. And, it only affects users using NT Server 4.0 Service Pack 6a and NT Server 4.0 Terminal Server Edition Service Pack 6.

In addition to an attacker who exploits this volunerability successfully being able to take control of the system, unsuccessful attacks on it can result in a denial of service attack (DDOS) on your system, crippling the DHCP server.

And, last but not least…

5. Vulnerability in WINS

WINS is the Windows Internet Naming Service, and this vulnerability affects only those users who are using Windows NT, Windows 2000, and Windows Server. This vulnerability also allows Internet badies to take complete control of the affected system.

If you believe that your system might be affected by any of these vulnarabilities, you or whomever administers your system should update your system right away.

Here are the links to the specific updates:

Link to WordPad Volunerability Information

Link to Windows Kernal Vulnerability Information

Link to HyperTerminal Vulnerability Information

Link to DHCP Server Vulnerability Information

Link to WINS Vulnerability Information