Skip to main content
MSRC

2009

Assessing the risk of the schannel.dll vulnerability (MS09-007)

Tuesday, March 10, 2009

MS09-007 resolves an issue in which an attacker may be able to log onto an SSL protected server which is configured to use certificate based client authentication with only the public key component of a certificate, not the associated private key. Only a subset of customers who log into SSL protected servers are at risk but it is a little tricky to explain who might be affected due to the unique nature of this vulnerability.

Read More

March 2009 Monthly Bulletin Release

Tuesday, March 10, 2009

Hi, Bill here, The March 2009 release contains 3 new bulletins, 1 of which has a maximum severity of “Critical”. MS09-006 - Vulnerabilities in Windows Kernel Could Allow Remote Code Execution (958690) MS09-007 - Vulnerability in SChannel Could Allow Spoofing (960225) MS09-008 - Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238) We also revised bulletin MS08-052 Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593), to note a revision to some of the packages associated with this bulletin (specifically 938464).

Read More

Security Bulletin Overview Video - March 2009

Tuesday, March 10, 2009

Hi Everyone, This month we are adding another new video feature. In addition to the entire security bulletin webcast recordings being posted for you to playback (available later this week), we are also providing a short, five to ten minute overview of the bulletins we have released. These clips will focus on the severity of the issue and the exploitability index ratings we have assigned them in order to help you get a quick understanding of the impact to your environment.

Read More

CanSecWest Preview & New Blog URL

Thursday, March 05, 2009

It’s getting busy around here with people preparing for the CanSecWest security conference (http://cansecwest.com/). Many of the Microsoft Security Engineering Center (MSEC) and Microsoft Security Response Center (MSRC) members that regularly post to this blog will be attending CanSecWest and soaking up the 3 days of presentations & networking. If you haven’t heard us talk about the Security Science angle of MSEC before, let me explain.

Read More

March 2009 Advanced Notification

Thursday, March 05, 2009

Hello, Bill here. I wanted to let you know that we just posted our Advance Notification for next week’s bulletin release, scheduled for Tuesday, March 10, 2009 around 10 a.m. Pacific Standard Time. As part of this month’s security bulletin release process, we will issue three security bulletins – one rated ‘Critical’ and two rated ‘Important’ – to address vulnerabilities in Microsoft Windows.

Read More

Behavior of ActiveX controls embedded in Office documents

Tuesday, March 03, 2009

The Microsoft Office applications (Word, Excel, PowerPoint, etc) have built-in ActiveX control support. ActiveX support allows a richer experience when interacting with an Office document. For example, a document author could use the Safe-For-Initialization Office Web Components (OWC) ActiveX control to retrieve data from an intranet data source. Office applications’ prompting behavior

Read More