Few hours ago Microsoft released bulletins accordingly with patches, among others also for extreme critical vulnerabilities in Internet Explorer and Windows. It should be no wonder, that Microsoft releases updates if... If these vulnerabilities were not old and already exploited in the wild. Let's take a brief summary on these:

Bulletin MS07-069 issued on December 11, 2007
Internet Explorer from version 5.01 to version 7 is affected, successful exploitation requires user's interaction (visiting malicious website), results in remote code execution. Update patches four (4) different vulnerabilities.

According to ZDI advisory, vulnerability was reported to vendor in May 2007 and July 2007.

Bulletin MS07-065 issued on December 11, 2007
Windows 200SP4 and XPSP2 with enabled Message Queuing Service. To exploit this vulnerability authentication is not required. Successful exploitation allows remote attacker execute arbitrary code (on Windows2000SP4) or escalate the privileges (on XP).

According to ZDI advisory, it was reported in April 2007.

Why patch release came after relatively long time, is unknown. One thing is sure: if we post next time, that data theft rised again, we can also add, that this might be also the reason.

Comments Index (Total Messages: 1)

very cool Written by eagle.eyez on 2007-12-13 15:18:44

Powered by a Zone-H(ified) version of AkoComment 3.0!