Microsoft Security Bulletins for April

April 11, 2006

Today Microsoft released the following Security Bulletin(s).

Bulletin Summary:
http://www.microsoft.com/technet/security/...n/ms06-Apr.mspx

Critical Bulletins:

Cumulative Security Update for Internet Explorer (912812)
http://www.microsoft.com/technet/security/...n/ms06-013.mspx

Vulnerability in the Microsoft Data Access Components (MDAC) Function Could Allow Code Execution (911562)
http://www.microsoft.com/technet/security/...n/ms06-014.mspx

Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531)
http://www.microsoft.com/technet/security/...n/ms06-015.mspx

Important Bulletins:

Cumulative Security Update for Outlook Express (911567)
http://www.microsoft.com/technet/security/...n/ms06-016.mspx

Moderate Bulletins:

Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting (917627)
http://www.microsoft.com/technet/security/...n/ms06-017.mspx

Re-Released Bulletins:

Vulnerability in Windows Media Player Could Allow Remote Code Execution
(911565)
http://www.microsoft.com/technet/security/...n/ms06-005.mspx

 

Re: Microsoft Security Bulletins for April

Microsoft will host a webcast to address customer questions on these bulletins. For more information on this webcast please see below:
TechNet Webcast: Information About Microsoft April Security Bulletins (Level 200)
Wednesday, 12 April 2006 11:00 AM (GMT-08:00) Pacific Time (US & Canada)
Presenter: Christopher Budd, CISA, CISM, CISSP, ISSMP Security Program Manager, PSS Security, Microsoft Corporation and Stephen Toulouse, Security Program Manager, Microsoft Corporation

http://msevents.microsoft.com/CUI/W...4&EventCategory=4&culture=en-US&CountryCode=U

Security Tool:
Find out if you are missing important Microsoft product updates by using MBSA

Remember to call Microsoft at 1-866-PCSAFETY for security patches issues if you are in the US and Canada. For other location, go here.

 

Re: Microsoft Security Bulletins for April

HP users, beware:

Problems in Windows Explorer or the Windows shell after you install security update

MS06-015http://support.microsoft.com/default.aspx/kb/918165

http://www.microsoft.com/technet/security/Bulletin/ms06-015.mspx



The MS06-015 security update package installs a new binary, VERCLSID.EXE, which validates shell extensions before they are instantiated by the Windows Shell or Windows Explorer. On some computers, VERCLSID.EXE stops responding. There have been reported issues where HP software causes the VERCLSID.EXE process to stop responding.
The reg fix is here:
http://www.kellys-korner-xp.com/xp_tweaks.htm
(line 383, right-hand side)



--------------------------------------------------------------------------------

This news courtesy of James M Fisher [MVP]​

 

Re: Microsoft Security Bulletins for April

Microsoft Security Bulletin MS06-015 revised

Microsoft Security Bulletin MS06-015
Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531)
Published: April 11, 2006 | Updated: April 15, 2006

Revision:
V1.1 (April 15, 2006): Bulletin revised: “Caveats” section updated due to new issues discovered with the security update. Users may experience issues in Windows Explorer or the Windows shell after installing the update. Security Update Information revised to reflect correct file version information for Microsoft Windows XP and Microsoft Windows 2000.

 

Re: Microsoft Security Bulletins for April

Update to the MS06-015 issue.

 

Re: Microsoft Security Bulletins for April

To Whom it may concern

FAQ ...For customers who have already applied the update and are experiencing the problem related to the older Hewlett Packard Share-to-Web software, or older NVIDIA drivers prior to or including version 61.94, the revised update will be available through Windows Update and Microsoft Update. The targeted re-release will be automatically delivered to affected computers through Automatic Update if it has been enabled. The re-release will not be distributed to non-affected computers...
• V1.2 (April 20, 2006): Bulletin revised: FAQ Section updated to include information about an upcoming re-release of the security update."
Microsoft Security Bulletin MS06-015
Vulnerability in Windows Explorer Could Allow Remote Code Execution (908531)
Published: April 11, 2006 | Updated: April 20, 2006

Version: 1.2

Summary
Who should read this document: Customers who use Microsoft Windows

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately.

Security Update Replacement: This bulletin replaces several prior security updates. See the frequently asked questions (FAQ) section of this bulletin for the complete list.

Caveats: Microsoft Knowledge Base Article 918165 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues. For more information, see Microsoft Knowledge Base Article 918165.

Tested Software and Security Update Download Locations:

Affected Software:

• Microsoft Windows 2000 Service Pack 4 – Download the update

• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 – Download the update

• Microsoft Windows XP Professional x64 Edition – Download the update

• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 – Download the update

• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems – Download the update

• Microsoft Windows Server 2003 x64 Edition – Download the update

• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) – Review the FAQ section of this bulletin for details about these operating systems.


The software in this list has been tested to determine whether the versions are affected. Other versions either no longer include security update support or may not be affected. To determine the support life cycle for your product and version, visit the Microsoft Support Lifecycle Web site.

http://www.microsoft.com/technet/security/bulletin/ms06-015.mspx

 

Re: Microsoft Security Bulletins for April

Microsoft wil re-release Windows patch MS06-015 on Tuesday, April 25th

From the MSRC Blog: We've been continually examining the best way to assist the customers who may have been impacted by the interaction of MS06-015 with the software Mike mentioned before. We wanted to check in and let you know the current plan. Up until now there have been several solutions: Upgrade to the newest version of the affected software, a manual registry key fix, uninstall the third party software (NVIDIA Drivers versions 61.94 and prior or the Hewlett Packard Share-to-web software) or uninstall the update. All of these require the user to take some sort of action.

So what we have done is re-engineered the MS06-015 update to avoid the conflict altogether with the older Hewlett Packard and NVIDIA software. We're going to run a test pass on it and we will release this new update on Tuesday, April 25th. What the new update essentially does is simply add the affected third party software to an "exception list" so that the problem does not occur. The revised update automates the manual registry key fix.

So what should you do?

Well if you are experiencing the problem right now, you can use the currently available reg key fix documented in 918165, go to the newest versions of the affected software, or uninstall the third party software. On Tuesday April 25th, if you have not taken those actions but are having the problem, the update MS06-015 will be delivered to the machine through AU if configured, or through Microsoft Update or the Download Center if you want to install it manually.

I want to be real clear about that. When the update is re-released, it's going to be very much targeted to people who are having the problem, or people who have not installed MS06-015 yet. That means if you have already installed MS06-015 and are not having the problem, there's no action here for you.

Windows Update, Microsoft Update, and Automatic Update will have detection logic built into them to only offer the revised update (which essentially includes the reg key fix) to those customers who either don't have MS06-015 or are having the problem.

We've updated the bulletin to reflect this information as well.

http://blogs.technet.com/msrc/archive/2006/04/21/425838.aspx

 

Re: Microsoft Security Bulletins for April

Windows Genuine Advantage Notification (KB905474)
Date last published: 4/25/2006
Download size: 829 KB
The Windows Genuine Advantage Notification tool notifies you if your copy of Windows is not genuine. If your system is found to be a non-genuine, the tool will help you obtain a licensed copy of Windows.
http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us

Update for Windows XP (KB900485)
Typical download size: 149 KB , less than 1 minute
Install this update to prevent an issue in which you may receive a “stop 0x7e in AEC.SYS” error message on a computer that is running Windows XP Service Pack 2. The error may occur during startup, or after the system has started. AEC.SYS is the acoustic echo canceling driver. After you install this item, you may have to restart your computer.
Details...
http://support.microsoft.com/default.aspx/kb/900485

Security Update for Windows XP (KB908531)
Typical download size: 789 KB , 1 minute
A security issue has been identified in Windows Explorer that could allow an attacker to compromise your Windows-based system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.
NOTE: If you have already installed MS06-015 and are not having the problem, you need take no action.
Details...
http://www.microsoft.com/technet/security/Bulletin/MS06-015.mspx

 

Re: Microsoft Security Bulletins for April

Microsoft Security Bulletin MS06-016

Cumulative Security Update for Outlook Express (911567)
Published: April 11, 2006 | Updated: April 26, 2006

Version: 1.2

Summary
Who should read this document: Customers who use Microsoft Outlook Express

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Important

Recommendation: Customers should apply the update at the earliest opportunity

Security Update Replacement: This bulletin replaces two prior security updates. See the frequently asked questions (FAQ) section of this bulletin for the complete list.

Caveats: Microsoft Knowledge Base Article 911567 documents the currently known issues that customers may experience when they install this security update. The article also documents recommended solutions for these issues. For more information, see Microsoft Knowledge Base Article 911567.

Tested Software and Security Update Download Locations:

http://www.microsoft.com/technet/security/bulletin/ms06-016.mspx

Affected Software:

• Microsoft Windows 2000 Service Pack 4

• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2

• Microsoft Windows XP Professional x64 Edition

• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1

• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems

• Microsoft Windows Server 2003 x64 Edition

• Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (Windows Me) – Review the FAQ section of this bulletin for details about these operating systems.


Tested Microsoft Windows Components:
Affected Components:

• Outlook Express 6 on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 - Download the update

• Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition - Download the update

• Outlook Express 6 Microsoft Windows Server 2003 on Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems - Download the update

• Outlook Express 6 on Microsoft Windows XP Service Pack 2 - Download the update

• Outlook Express 6 on Microsoft Windows XP Professional x64 Edition - Download the update

• Outlook Express 6 Service Pack 1 on Microsoft Windows XP Service Pack 1 or when installed on Microsoft Windows 2000 Service Pack 4 - Download the update

• Outlook Express 5.5 Service Pack 2 on Microsoft Windows 2000 Service Pack 4 - Download the Update


Note The security updates for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 also apply to Microsoft Windows Server 2003 R2.