Microsoft Security Bulletin informiert/Download

Windows XP Patch: Hibernation Problem on Computers with 1 GB of RAM - Deutsch

QuickInfo
Dateiname: Q330909_WXP_SP2_x86_DEU.exe
Downloadgröße: 3332 KB
Veröffentlichungsdatum: 27.02.2003
Version: Q330909

Systemanforderungen
Unterstützte Betriebssysteme: Windows XP
Windows XP Professional
Windows XP Home Edition

http://download.microsoft.com/downl...97c6-442e01e33d80/Q330909_WXP_SP2_x86_DEU.exe

Zum Vergrößern anklicken....

Title: Unchecked buffer in Windows component could cause web
server compromise (815021)
Date: 17 March, 2003
Software: Microsoft Windows 2000
Impact: Run Code of Attacker's Choice
Max Risk: Critical
Bulletin: MS03-007

Microsoft encourages customers to review the Security Bulletins
at:
http://www.microsoft.com/technet/security/bulletin/MS03-007.asp
http://www.microsoft.com/security/security_bulletins/ms03-007.asp

Zum Vergrößern anklicken....

Microsoft Security Bulletin MS03-007

Ungeprüfter Speicherpuffer in Windows Komponente kann zur Beeinträchtigung von Web Server führen (815021)

Erstveröffentlichung: 17. März 2003 (letzte Aktualisierung am 28. Mai 2003)

Zurück zur Übersicht

Zusammenfassung

Zielgruppe dieses Bulletins: Systemadministratoren für Microsoft Windows NT 4.0, Microsoft Windows 2000 und Microsoft Windows XP

Folge der Sicherheitslücke: Ausführung von beliebigem Code durch Angreifer

Bewertung des maximalen Schweregrads: Kritisch

Empfehlung: Systemadministratoren sollten den Patch sofort installieren

Endbenutzer-Bulletin: Eine englischsprachige Endbenutzerversion dieses Bulletins ist hier verfügbar.

Betroffene Software:

* Microsoft Windows NT 4.0
* Microsoft Windows NT 4.0 Terminal Server Edition
* Microsoft Windows 2000
* Microsoft Windows XP

Nicht betroffene Software:

* Microsoft Windows Server 2003

Zum Vergrößern anklicken....

Download-Adresse für diesen Patch

Microsoft Windows NT 4.0
http://microsoft.com/downloads/deta...1A-05AE-4912-9967-3AA3B4D5A76F&displaylang=de
http://download.microsoft.com/download/0/c/0/0c053cd2-535f-42df-9cba-df764735a2a4/DEUq815021i.EXE

Microsoft Windows NT 4.0 Terminal Server Edition
http://microsoft.com/downloads/deta...7F-DC4D-40E9-8879-41A09767111F&displaylang=de
http://download.microsoft.com/download/e/a/e/eaedcc25-a42c-4ed2-93e9-34497422193e/DEUq815021i.EXE

Microsoft Windows 2000
http://microsoft.com/downloads/deta...45-5145-4844-B62E-C69D32AC929B&displaylang=de
http://download.microsoft.com/downl...-b6e2-2408d392d347/Q815021_W2K_sp4_x86_DE.EXE

Microsoft Windows XP (32-Bit-Edition)
http://microsoft.com/downloads/deta...7D-F2D5-47B8-AB98-77BA7501B00B&displaylang=de
http://download.microsoft.com/downl...9bf7-1749162e419c/Q815021_WXP_SP2_x86_DEU.exe

Microsoft Windows XP (64-Bit-Edition)
http://microsoft.com/downloads/deta...5D-DB0B-40F8-9A2E-DE93CBB5CB3A&displaylang=de
http://download.microsoft.com/downl...1da-b12eb90a9b2f/Q815021_WXP_SP2_ia64_DEU.exe

Zum Vergrößern anklicken....

- -------------------------------------------------------------------
Title: Flaw In ISA Server DNS Intrusion Detection Filter Can
Cause Denial Of Service (331065)
Date: 19 March 2003
Software: Microsoft ISA Server
Impact: Denial of Service
Max Risk: Moderate
Bulletin: MS03-009

Microsoft encourages customers to review the Security Bulletins at:
http://www.microsoft.com/technet/security/bulletin/MS03-009.asp
http://www.microsoft.com/security/security_bulletins/ms03-009.asp
- -------------------------------------------------------------------

Issue:
======
Microsoft Internet Security and Acceleration (ISA) Server 2000
contains the ability to apply application filters to incoming
traffic. Application filters allow ISA Server to analyze a data
stream for a particular application and provide application-
specific processing including inspecting, screening or blocking,
redirecting, or modifying the data as it passes through the
firewall. This mechanism is used to protect against invalid URLs
which may indicate attempted attacks as well as attacks against
internal Domain Name Service (DNS) Servers.

A flaw exists in the ISA Server DNS intrusion detection application
filter, and results because the filter does not properly handle a
specific type of request when scanning incoming DNS requests.

An attacker could exploit the vulnerability by sending a specially
formed request to an ISA Server computer that is publishing a DNS
server, which could then result in a denial of service to the
published DNS server. DNS requests arriving at the ISA Server would
be stopped at the firewall, and not passed through to the internal
DNS server. All other ISA Server functionality would be unaffected.

Mitigating Factors:
====================
- By default, no DNS servers are published. DNS server publishing

must be manually enabled.
- The vulnerability would not enable an attacker to gain any
privileges on an affected ISA Server or the published DNS server
or to compromise any cached content on the server. It is
strictly a denial of service vulnerability.


Risk Rating:
============
- Moderate

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-009.asp
http://www.microsoft.com/security/security_bulletins/ms03-009.asp

for information on obtaining this patch.


- -------------------------------------------------------------------

Zum Vergrößern anklicken....

ISA Server 2000 Security Patch für DNS Intrusion Detection Filter

Während das DNS auf dem Server veröffentlicht wird, kann ein Fehler im
DNS-Filter zur Erkennung von Eindringversuchen des ISA Servers zu einem
Denial-of-Service-Angriff führen.

QuickInfo
Dateiname: isahf256.exe
Downloadgröße: 101 KB
Veröffentlichungsdatum: 19.03.2003
Version: 3.0.1200.256

Übersicht
Während das DNS auf dem Server veröffentlicht wird, kann ein Fehler im
DNS-Filter zur Erkennung von Eindringversuchen des ISA Servers zu einem
Denial-of-Service-Angriff führen. Wenn Ihr ISA Server so konfiguriert wurde,
dass das DNS auf dem Server veröffentlich wird, ist der DNS-Filter zur
Erkennung von Eindringversuchen u.U. nicht in der Lage, einen bestimmten
Anforderungstyp angemessen zu behandeln. In diesem Fall würde der ISA Server
keine weiteren DNS-Anforderungen an den DNS-Server senden. Andere
ISA Serverfunktionen wären davon nicht betroffen.

Dieses Problem wird von diesem Security Patch gelöst.

Verwandte Ressourcen

Microsoft-Sicherheitsbulletin MS03-009
http://go.microsoft.com/fwlink/?linkid=14902
Knowledge Base-Artikel 331065
http://go.microsoft.com/fwlink/?linkid=14903

Systemanforderungen
Unterstützte Betriebssysteme: Windows 2000, Windows Server 2003

• Microsoft Internet Security and Acceleration Server 2000
• Microsoft Internet Security and Acceleration Server 2000, Service Pack 1

http://download.microsoft.com/download/7/0/f/70fe2a25-d1d7-4c0d-a4bd-e2a740435077/isahf256.exe

Zum Vergrößern anklicken....

- -------------------------------------------------------------------
Title: Flaw in Windows Script Engine Could Allow Code
Execution (814078)
Date: 19 March 2003
Software: Microsoft Windows 98
Microsoft Windows 98 Second Edition
Microsoft Windows Me
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0 Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP
Impact: Run Code of Attacker's Choice
Max Risk: Critical
Bulletin: MS03-008

Microsoft encourages customers to review the Security Bulletins at:
http://www.microsoft.com/technet/security/bulletin/MS03-008.asp
http://www.microsoft.com/security/security_bulletins/ms03-008.asp
- -------------------------------------------------------------------

Issue:
======
The Windows Script Engine provides Windows operating systems with
the ability to execute script code. Script code can be used to add
functionality to web pages, or to automate tasks within the
operating system or within a program. Script code can be written in
several different scripting languages, such as Visual Basic Script,
or JScript.

A flaw exists in the way by which the Windows Script Engine for
JScript processes information. An attacker could exploit the
vulnerability by constructing a web page that, when visited by the
user, would execute code of the attacker's choice with the user's
privileges. The web page could be hosted on a web site, or sent
directly to the user in email.

Although Microsoft has supplied a patch for this vulnerability and
recommends all affected customers install the patch immediately,
additional preventive measures have been provided that customers
can use to help block the exploitation of this vulnerability while
they are assessing the impact and compatibility of the patch. These
temporary workarounds are discussed in the "Workarounds" section in
the Frequently Asked Questions section of the security bulletin for
this release.


Mitigating Factors:
====================
- For an attack to be successful, the user would need to visit a
website under the attacker's control or receive an HTML e-mail
from the attacker.
- Computers configured to disable active scripting in Internet
Explorer are not susceptible to this issue.
- Exploiting the vulnerability would allow the attacker only the
same privileges as the user. Users whose accounts are configured
to have few privileges on the system would be at less risk than
ones who operate with administrative privileges.
- Automatic exploitation of the vulnerability by an HTML email
would be blocked by Outlook Express 6.0 and Outlook 2002 in
their default configurations, and by Outlook 98 and 2000 if used
in conjunction with the Outlook Email Security Update.


Risk Rating:
============
- Critical

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-008.asp
http://www.microsoft.com/security/security_bulletins/ms03-008.asp

for information on obtaining this patch.


- -------------------------------------------------------------------

Zum Vergrößern anklicken....

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Windows 98 and Windows 98 SE:
http://www.microsoft.com/windows98/downloads/contents/WUCritical/q814078/default.asp

Windows Me:
Windows Update.
http://windowsupdate.microsoft.com/

Windows NT 4.0:
http://microsoft.com/downloads/deta...D9-5E2C-45BF-9424-55D7C5D2221B&displaylang=en

Windows NT 4.0, Terminal Server Edition:
http://microsoft.com/downloads/deta...D9-5E2C-45BF-9424-55D7C5D2221B&displaylang=en

Windows 2000:
http://microsoft.com/downloads/deta...D4-B4D6-49D5-8C58-199BDC731B64&displaylang=en

Windows XP Home Edition and Professional Edition:
http://microsoft.com/downloads/deta...D4-B4D6-49D5-8C58-199BDC731B64&displaylang=en

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JScript 5.6 Security Patch for Windows 98, Me and NT 4.0 - Q814078 - Deutsch

QuickInfo
Dateiname: js56mde.exe
Downloadgröße: 365 KB
Veröffentlichungsdatum: 19.03.2003
Version: 5.6

Übersicht
A flaw exists in the way by which the Windows Script Engine for JScript processes information.
An attacker could exploit the vulnerability by constructing a Web page that, when visited by
the user, would execute code of the attacker’s choice with user privileges. The Web page could
be hosted on a Web site, or sent directly to the user in email. For more information,
see Knowledge Base Article 814078.
http://support.microsoft.com/default.aspx?scid=kb;[LN];814078

Systemanforderungen
Unterstützte Betriebssysteme: Windows 98, Windows ME, Windows NT

http://download.microsoft.com/download/0/4/0/040935a9-fabc-4bc8-987f-25706600acdf/js56mde.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JScript 5.6 Security Patch for Windows 2000 and XP - Q814078 - Deutsch

QuickInfo
Dateiname: js56nde.exe
Downloadgröße: 365 KB
Veröffentlichungsdatum: 19.03.2003
Version: 5.6

Übersicht
A flaw exists in the way by which the Windows Script Engine for JScript processes information.
An attacker could exploit the vulnerability by constructing a Web page that, when visited by
the user, would execute code of the attacker’s choice with user privileges. The Web page could
be hosted on a Web site, or sent directly to the user in email. For more information, see
Knowledge Base Article 814078.
http://support.microsoft.com/default.aspx?scid=kb;[LN];814078

Systemanforderungen
Unterstützte Betriebssysteme: Windows 2000, Windows XP
http://download.microsoft.com/download/b/b/7/bb729bb9-4c38-4c82-ba78-4f17ddaaddeb/js56nde.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JScript 5.6 Security Patch for Windows Me:
>> Windows Update.
http://windowsupdate.microsoft.com/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zum Vergrößern anklicken....

Patch friert Rechner ein

Der am Montag von Microsoft veröffentlichte Patch für Windows 2000 wurde mit der heißen Nadel gestrickt und "friert" einige Rechner ein. Das bestätigt ein Microsoft-Verantwortlicher gegenüber C|Net. Er meint weiter, dass einige Rechner nach der Installation des Updates nicht mehr laufen.

Es sei allerdings notwendig gewesen, diesen Patch sehr schnell zu veröffentlichen, da ein Kunde bereits auf Grundlage einer neuen Sicherheitslücke angegriffen worden sei. Es habe daher Grund zur Eile bestanden. Inzwischen wurde das Security Bulletin überarbeitet und liefert Hinweise, unter welchen Umständen mit Problemen zu rechnen ist. Der Patch wurde offenbar nicht überarbeitet.

Der "Kunde" war, wie ebenfalls inzwischen bekannt wurde, das US-Militär. Ein WWW-Auftritt der Armee sei Ziel eines Angriffs gewesen sein. Allerdings wird inzwischen von Seiten des Militärs bestritten, dass der Rechner unter eigener Regie betrieben wurde.


Microsoft Security Bulletin MS03-007 (überarbeitet)
http://www.microsoft.com/technet/security/bulletin/MS03-007.asp

Zum Vergrößern anklicken....

Title: Flaw in RPC Endpoint Mapper Could Allow Denial of
Service Attacks (331953)
Date: 26 March 2003
Software: Microsoft(r) Windows(r) NT 4.0, Windows 2000, or
Windows XP
Impact: denial of service
Max Risk: Important
Bulletin: MS03-010

Microsoft encourages customers to review the Security Bulletins
at:

http://www.microsoft.com/technet/security/bulletin/MS03-010.asp
http://www.microsoft.com/security/security_bulletins/ms03-010.asp
- ----------------------------------------------------------------------

Zum Vergrößern anklicken....

Installationsplattformen:

Der Windows 2000-Patch kann auf Systemen mit Windows 2000 Service Pack 2 oder Windows 2000 Service Pack 3 installiert werden. Der Patch für Windows XP kann auf Systemen mit Windows XP Gold oder Windows XP Service Pack 1 installiert werden.

Aufnahme in zukünftige Service Packs:

Die Fehlerbehebung für dieses Problem wird in Windows 2000 Service Pack 4 und Windows XP Service Pack 2 enthalten sein.

Zum Vergrößern anklicken....

Softwarearchitektonische Einschränkungen von Windows NT 4.0 unterstützten die zur Beseitigung des Problems notwendigen Änderungen nicht. Benutzer von Windows NT 4.0 werden nachdrücklich dazu angehalten, die Workarounds, die weiter unten in diesem Bulletin beschrieben werden, durchzuführen – Windows NT 4.0 Systeme werden dabei durch eine Firewall geschützt, die den Port 135 blockieren.

Zum Vergrößern anklicken....

--------------------------------------------------------------------

Title: Flaw in Microsoft VM Could Enable System Compromise
(816093)
Date: 09 April 2003
Software: Microsoft VM
Impact: Allow attacker to execute code of his or her choice
Max Risk: Critical
Bulletin: MS03-011

Microsoft encourages customers to review the Security Bulletins
at:

http://www.microsoft.com/technet/security/bulletin/MS03-011.asp
http://www.microsoft.com/security/security_bulletins/ms03-011.asp
- -------------------------------------------------------------------


Issue:
======
The Microsoft VM is a virtual machine for the Win32(r) operating
environment. The Microsoft VM is shipped in most versions of
Windows, as well as in most versions of Internet Explorer.

The present Microsoft VM, which includes all previously released
fixes to the VM, has been updated to include a fix for the newly
reported security vulnerability. This new security vulnerability
affects the ByteCode Verifier component of the Microsoft VM, and
results because the ByteCode verifier does not correctly check for
the presence of certain malicious code when a Java applet is being
loaded. The attack vector for this new security issue would likely
involve an attacker creating a malicious Java applet and inserting
it into a web page that when opened, would exploit the
vulnerability. An attacker could then host this malicious web page
on a web site, or could send it to a user in e-mail.


Mitigating Factors:
====================

- - In order to exploit this vulnerability via the web-based attack
vector, the attacker would need to entice a user into visiting a
web site that the attacker controlled. The vulnerability themselves
provide no way to force a user to a web site.

- - Java applets are disabled within the Restricted Sites Zone. As a
result, any mail client that opened HTML mail within the Restricted
Sites Zone, such as Outlook 2002, Outlook Express 6, or Outlook 98
or 2000 when used in conjunction with the Outlook Email Security
Update, would not be at risk from the mail-based attack vector.

- - The vulnerability would gain only the privileges of the user, so
customers who operate with less than administrative privileges
would be at less risk from the vulnerability.

- - Corporate IT administrators could limit the risk posed to their
users by using application filters at the firewall to inspect and
block mobile code.


Risk Rating:
============
Critical

Patch Availability:
===================
A patch is available to fix this vulnerability. Please read the
Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-011.asp
http://www.microsoft.com/security/security_bulletins/ms03-11.asp

for information on obtaining this patch.

- ----------------------------------------------------------------

Zum Vergrößern anklicken....

- -------------------------------------------------------------------

Title: Flaw In Winsock Proxy Service And ISA Firewall Service
Can Cause Denial Of Service (331066)
Date: 09 April 2003
Software: Microsoft Proxy Server 2.0, Microsoft ISA Server
Impact: denial of service
Max Risk: Important
Bulletin: MS03-012

Microsoft encourages customers to review the Security Bulletins
at:

http://www.microsoft.com/technet/security/bulletin/MS03-012.asp
http://www.microsoft.com/security/security_bulletins/ms03-012.asp
- -------------------------------------------------------------------


Issue:
======
There is a flaw in the Winsock Proxy service in Microsoft Proxy
Server 2.0, and the Microsoft Firewall service in ISA Server 2000,
that would allow an attacker on the internal network to send a
specially crafted packet that would cause the server to stop
responding to internal and external requests. Receipt of such a
packet would cause CPU utilization on the server to reach 100%, and
thus make the server unresponsive. The Winsock Proxy service and
Microsoft Firewall service work with FTP, telnet, mail, news,
Internet Relay Chat (IRC), or other client applications that are
compatible with Windows Sockets (Winsock). These services allow
these applications to perform as if they were directly connected to
the Internet. These services redirect the necessary communications
functions to a Proxy Server 2.0 or ISA Server computer, thus
establishing a communication path from the internal application to
the Internet through it.

Mitigating Factors:
====================

- - The vulnerability would not enable an attacker to gain any
privileges on an affected Proxy Server 2.0 or ISA Server computer
or compromise any cached content. It is strictly a denial of
service.

- - ISA Server computers running in cache mode are not affected
because the Microsoft Firewall service is disabled by default.


Risk Rating:
============
Important

Patch Availability:
===================
A patch is available to fix this vulnerability. Please read the
Security Bulletins at

http://www.microsoft.com/technet/security/bulletin/ms03-012.asp
http://www.microsoft.com/security/security_bulletins/ms03-12.asp

for information on obtaining this patch.

- ----------------------------------------------------------------

Zum Vergrößern anklicken....

- - -----------------------------------------------------------------
Title: Patch Available for
'Indexing Services Cross Site Scripting' Vulnerability
Released: 02 November 2000
Revised: 09 April 2003 (version 2.0)
Software: Microsoft Indexing Services for Windows 2000
Microsoft Indexing Services for Windows NT 4.0
Impact: Cross Site Scripting
Bulletin: MS00-084

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS00-084.asp
- - -----------------------------------------------------------------

Reason for Revision:
====================
Subsequent to the release of this bulletin, it was discovered
that an available package for the version of the Indexing Service
which shipped with the NT 4.0 Option Pack had never been released.
The bulletin is being updated to include the download locations for
that version of the fix.

Issue:
======
On February 20, 2000, Microsoft and the CERT Coordination Center
published information on a newly-identified security vulnerability
affecting all web server products. This vulnerability, known as
Cross-Site Scripting (CSS), results when web applications don't
properly validate inputs before using them in dynamic web pages.
If a malicious web site operator were able to lure a user to his
site, and had identified a third-party web site that was vulnerable
to CSS, he could potentially use the vulnerability to "inject"
script into a web page created by the other web site, which would
then be delivered to the user. The net effect would be to cause
the malicious user's script to run on the user's machine using
the trust afforded the other site.

The vulnerability can affect any software that runs on a web
server, accepts user input, and uses it to generate web pages
without sufficient validation. Microsoft has identified an
Indexing Service component (CiWebHitsFile) that, when called
from a specially crafted URL, is vulnerable to this scenario.

Mitigating Factors:
===================
- The Indexing Service ships and installs with Windows 2000,
but is not enabled by default.
- The Indexing Service for Windows NT 4.0 ships with the
NT Option Pack, and is not installed or enabled by default.

Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletins at
http://www.microsoft.com/technet/security/bulletin/ms00-084.asp
for information on obtaining this patch.

Acknowledgment:
===============
- Eiji "James" Yoshida <mailtotrs-ejy@bp.iij4u.or.jp>

- - -----------------------------------------------------------------

Zum Vergrößern anklicken....