Some of the vulnerabilities have been rated as critical by
Microsoft
Sophos, a world leader in IT security and control, has advised
computer users to install a number of critical security patches
from Microsoft released today.
As part of its monthly "Patch Tuesday" schedule Microsoft has
issued five new bulletins (four of them labeled "critical") about
security vulnerabilities in its software. The most serious security
flaws described could allow remote code execution, enabling a
hacker to access data on a vulnerable PC or run malicious code such
as a worm.
-
MS07-018. Critical.
Could allow Remote Code Execution. Affects Microsoft Content
Management Server.
-
MS07-019. Critical.
Could allow Remote Code Execution. Affects Universal Plug and
Play.
-
MS07-020. Critical.
Could allow Remote Code Execution. Affects Microsoft Agent.
-
MS07-021. Critical.
Could allow Remote Code Execution. Affects CSRSS (Windows
Client/Server Run-time Subsystem)
-
MS07-022. Important.
Could allow Remote Elevation of Privilege. Affects Windows
Kernel.
The release of the patches follows one week after Microsoft
released an emergency
update to fix a flaw in the way Windows handles animated
cursors (ANI files). Many attempts by hackers have been made to
exploit this flaw during April, including a malicious spam campaign
that included a provocative
picture of Britney Spears.
"Many versions of Windows, including the latest edition of
Windows Vista, are affected by these critical security flaws," said
Graham Cluley,
senior technology consultant at Sophos. "Hackers will show no mercy
in taking advantage of these vulnerabilities in Microsoft's code
unless companies and home consumers patch against them as a matter
of priority. Anyone not taking these flaws seriously is asking for
trouble."
Home users of Microsoft Windows can visit update.microsoft.com to have their systems scanned for
Microsoft security vulnerabilities.
Sophos suggests that every IT manager responsible for security
should consider subscribing to vulnerability mailing lists such as
that operated by Microsoft at www.microsoft.com/technet/security/bulletin/notify.mspx.
Sophos continues to recommend companies protect their desktops
and servers with automatically updated
protection against viruses, spyware, and spam.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.