Skip to main content

Month Archives: January 2008

MSRC Blog: Security Advisory 947563

Tuesday, January 15, 2008

Hello, Bill here, I wanted to let you know that we have just posted Microsoft Security Advisory (947563). This advisory contains information about a targeted attack exploiting a vulnerability in Microsoft Office Excel. Our investigation has shown that this vulnerability affects Microsoft Office Excel 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel 2002, Microsoft Office Excel 2000 and Microsoft Excel 2004 for Mac.

January 2008 Monthly Release

Tuesday, January 08, 2008

Happy New Year! I hope 2008 is off to a wonderful start for you! This is Tami Gallupe, MSRC Release Manager, and we’re starting off the year here in MSRC-land with the release of two bulletins and a security advisory. The first bulletin, MS08-001, addresses a vulnerability in TCP(IP)/IGMP that could allow remote code execution.

MS08-001 (part 2) – The case of the Moderate ICMP mitigations

Tuesday, January 08, 2008

This is the second post in the three-part series covering MS08-001. In this post we’ll look at the ICMP vulnerability (CVE-2007-0066) in more detail. This vulnerability is caused by Windows TCP/IP’s handling of the ICMP protocol, specifically regarding router advertisement messages. This post covers the mitigating factors for this vulnerability in more detail.

MS08-001 (part 3) – The case of the IGMP network critical

Tuesday, January 08, 2008

This is the final post in the three-part series covering MS08-001. In this post we’ll look at the IGMP vulnerability (CVE-2007-0069) and why we think successful exploitation for remote code execution is not likely. This vulnerability is around Windows’ handling of the IGMP and MLD protocols. These two protocols are used to control multicast traffic over IPv4 and IPv6 networks, enabling hosts to advertise their intention to send & receive multicast traffic.