从图表到小配件，重要缺点影响窗口

严肃： 高

2007年8月14日，

总结：

今天，微软发布了描述影响运输与它的窗口和组分的弱点的四份安全公报。 一个遥远的攻击者在您的窗口个人计算机能剥削最坏这些缺点执行代码，潜在地获取全面控制它。 为简要地总结的桌窗口的版本，看见微软的弱点影响 安全公报总结8月 并且扩展部分， “影响了软件和下载地点”。 如果您处理一个窗口网络，您应该下载，测试和尽快部署适当的窗口补丁在您的网络中。

曝光：

微软的四个安全公报细节弱点发现了或者影响，窗口组分。 每个弱点影响窗口的不同的版本在不同的程度上。 总结在名单之下弱点从最高到最低的严肃。

MS07-046：图形设备接口(GDI)遥远的代码施行弱点

图形设备接口(GDI) 船以窗口的所有最新版遭受”介入方式的一个非特指的“代码施行弱点GDI处理特别地被制作的图象。 通过诱惑你的一名用户到开头和观察里一个恶意图象(例如，一个从网站或附有电子邮件)，攻击者在您的用户的机器可能利用这个弱点执行代码，以您的用户的特权。 如果您的用户有地方行政特权，攻击者获取您的用户的机器全面控制。 微软的公报不确切地指定什么样的图像文件触发这个弱点。 我们必须假设， GDI处理的每个图象类型(BMP、JPG、GIF等等)可能潜在地触发这个缺点。
微软规定值： 重要.

MS07-042: XML核心为内存损坏弱点服务

微软的XML核心服务(MSXML) 提供一个更高的支持程度为 XML 标准在窗口。 虽然XML核心服务不运送以窗口的所有版本，他们运送与各种各样普遍的微软产品和软件更新，包括Internet Explorer的有些版本。 您可能发现XML核心服务在大多您的窗口工作站。 (为包括XML核心服务产品的一个完整的目录，纸卷对底部 这 微软知识库文章。)

微软警告一个特别地被制作的剧本在XML核心服务可能导致内存损坏弱点。 通过欺骗你的一名用户到参观一个恶意网页里，攻击者在您的用户的计算机可能利用这个内存损坏弱点执行代码，继承您的用户的特权。 As usual, if your user has local administrator privileges, the attacker gains full control of the computer. This flaw affects all current versions of Windows and also affects Office.
Microsoft rating: Critical.

MS07-043: OLE Automation Memory Corruption Vulnerability

According to Microsoft, Object Linking and Embedding (OLE) Automation is a Windows protocol that allows an application to share data or control another application. Microsoft warns that a specially crafted script could cause a memory corruption vulnerability in the OLE Automation component. By enticing one of your users to a specially designed Web page, an attacker could exploit this vulnerability to execute code on that user’s computer with that user’s privileges. Since typical Windows users have local administrative privileges, attackers can usually exploit this flaw to gain complete control of Windows machines. This vulnerability also affects Office 2004 for Mac and Visual Basic 6.
Microsoft rating: Critical.

MS07-048: Three Remote Code Execution Vulnerabilities in Vista Gadgets

Windows Vista features a Sidebar with little mini-programs called Gadgets. Gadgets are designed to offer information at a glance, or to perform common tasks quickly. They’re very similar to OS X’s Dashboard Widgets. Vista’s Feed Headlines, Contacts, and Weather Gadgets all suffer from remote code execution vulnerabilities. An attacker can exploit any of these three vulnerabilities to run arbitrary programs on one of your Vista user’s computers, with that user’s privileges. Say it with us: If your users have local administrative privileges, the attacker gains complete control of their machines. How the attacker exploits these vulnerabilities depends on which Gadget she attacks. For instance, to exploit the Feed Headlines Gadget vulnerability, the attacker needs to entice your user to subscribe to an RSS feed, and then to download a specially crafted RSS post. In short, all three of these attacks require significant user interaction to succeed.
Microsoft rating: Important.

Solution Path

Microsoft has released patches for Windows to correct all of these vulnerabilities. You should download, test, and deploy the appropriate patches throughout your network immediately.

Note: Microsoft no longer officially supports Windows NT 4.0, 98, ME or XP with SP1. If you manage any of these operating systems, Microsoft suggests you migrate to supported versions to prevent potential exposure to vulnerabilities. You can learn more about Microsoft’s extended security update support at their Product Support Services Web site.

MS07-042:

• 2000
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• XP SP2
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• XP x64
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Server 2003
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Server 2003 Itanium Edition
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Server 2003 x64
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Vista
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Vista x64
  • XML Core Services 3.0
  • XML Core Services 4.0
  • XML Core Services 6.0
• Office
  • Office 2003
  • 2007 Office System
  • Office Sharepoint Server
  • Office Groove Server 2007

MS07-043:

• 2000
• XP SP2
• XP x64
• Server 2003
• Server 2003 Itanium Edition
• Server 2003 x64
• Office 2004 for Mac
• Visual Basic 6.0

MS07-046:

• 2000
• XP SP2
• XP x64
• Server 2003
• Server 2003 Itanium Edition
• Server 2003 x64

Doesn’t affect Vista.

MS07-048:

• Vista
• Vista x64

For All WatchGuard Users:

WatchGuard Fireboxes, by default, reduce the risks presented by many of these vulnerabilities. However, attackers could exploit some of these flaws via normal Web or email traffic. Because of the diversity of attack scenarios these vulnerabilities present, and the possibility of local (internal) attacks that do not pass through the firewall, we urge you to apply the patches above.

Status:

Microsoft has released patches correcting these issues.

References:

• Microsoft Security Bulletin MS07-042
• Microsoft Security Bulletin MS07-043
• Microsoft Security Bulletin MS07-046
• Microsoft Security Bulletin MS07-048