Risk: Medium
Spring is a time for growth. And Microsoft has taken this maxim to heart by releasing an unprecedented number of security fixes on the same day. It recently released four security patches to protect Windows users against 20 security vulnerabilities. Eight vulnerabilities are critical.
The most serious is a critical vulnerability in the Windows Local Security Authority Subsystem (LSASS), discovered by security tools outfit eEye. Serious vulnerabilities have also been uncovered in the Microsoft Abstract Syntax Notation One (ASN.1) library, the Negotiate Security Software Provider (SSP) interface, Microsoft RPC runtime library and the parsing of MIME encoded content by Outlook Express.
Less serious problems have been found in SSL handshakes, H.323 parsing in Netmeeting, Microsoft LDAP and the Help and Support Centre protocol.
These flaws are open to a raft of exploit mechanisms, which could allow skilled hackers to run amok.
Windows (all flavours including the supposedly super-secure Win 2003), IIS Web servers, Exchange servers, Internet Explorer, Outlook and Outlook Express all need patching, for one reason or another.
Microsoft's own summary, which can be read online, links to the four horsemen of cyber doom: a security update for Microsoft Windows (MS04-011); a cumulative update for Microsoft RPC/DCOM (MS04-012); a cumulative security update for Outlook Express (MS04-013) and a vulnerability in the Microsoft Jet Database Engine that could allow code execution (MS04-014).
The Jet Database patch is described as important, while the other three patches earn the dreaded critical sobriquet.
As if that wasn't enough, Microsoft also reissued four security fixes (the oldest of which dates back four years) to accompany an update for Exchange Server 5.0.