4 major Microsoft updates/patches for February of which 2 are critical.
1. MS09-003 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (959239)
A remote code-execution vulnerability affects Microsoft Exchange Server because of the way it handles Transport Neutral Encapsulation Format (TNEF) data. Attackers can exploit this issue by sending a specially crafted email message to an affected server and tricking a victim into opening the email. A successful exploit will result in the execution of attacker-supplied code in the context of the affected service.
Affects: Microsoft Exchange Server 2000 SP3, Microsoft Exchange Server 2003 SP2, and Microsoft Exchange Server 2007 SP1.
2. MS09-002 Cumulative Security Update for Internet Explorer (961260)
A remote code-execution vulnerability affects Internet Explorer because of the way it handles an object that has been deleted. An attacker can exploit this issue by tricking a victim into viewing a Web page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.
Affects: Internet Explorer 7.
3. MS09-004 Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420)
This is a previously public (Dec. 9, 2008) remote code-execution vulnerability affecting Microsoft SQL Server. The issue occurs when the server handles the 'sp_replwritetovarbin' extended stored procedure call. By supplying several uninitialized variables as parameters to the call, an attacker can write to a controlled memory location. An attacker needs the ability to execute arbitrary SQL on an affected server to exploit this issue. This could occur through legitimate means or through the exploit of other latent SQL injection vulnerabilities. Successful exploits will result in the execution of attacker-supplied code in the context of the affected service.
Affects: SQL Server 2000 SP4, SQL Server 2000 Itanium-based Edition SP4, SQL Server 2005 SP2, SQL Server 2005 x64 Edition SP2, SQL Server 2005 with SP2 for Itanium-based Systems, Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) SP4, Microsoft SQL Server 2005 Express Edition SP2, Microsoft SQL Server 2005 Express Edition with Advanced Services SP2, Microsoft SQL Server 2000 Desktop Engine (WMSDE), Windows Internal Database (WYukon) SP2 x64, and Windows Internal Database (WYukon) SP2.
4. MS09-005 Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (957634)
A remote code-execution vulnerability affects Microsoft Visio because it does not properly validate object data when opening a Visio file. An attacker can exploit this issue by tricking a victim into opening a malicious file. Successful attacks will result in the execution of arbitrary attacker-supplied code in the context of the currently logged-in user.
Affects: Microsoft Office Visio 2002 SP2, Microsoft Office Visio 2003 SP3, and Microsoft Office Visio 2007 SP1.
You can go to the Microsoft website to check for patches so you can keep your system up to date. Most Microsoft fixes are done automatically if you use Windows or Microsoft Update.
More Resources |
