The information
provided in this site is provided "as is" without warranty
of any kind. Microsoft Corporation disclaims all warranties,
either express or implied, including the warranties of merchantability
and fitness for a particular purpose. In no event shall
Microsoft Corporation or its suppliers be liable for any
damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages,
even if Microsoft Corporation or its suppliers have been
advised of the possibility of such damages. Some states do
not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation may not
apply. Furthermore, this information is only listed as a
resource for such information by Whiptech. Whiptech is in
no way responsible for the use or misuse of the information
by anyone, anywhere, at anytime.
 Microsoft Patch Disclosure - August 2006
Vulnerability in Microsoft Windows
Could Allow Remote Code Execution (920214)
Published:
August 8, 2006
Microsoft Severity Rating: Critical
Description:
This month we have yet another Internet Explorer Cumulative
Update. This one addresses eight different issues, some of which have
already been publicly disclosed. As with past Internet Explorer vulnerabilities,
all of these issues require vulnerable users to be tricked into visiting
a malicious website, or in some cases opening a malicious HTML file.
Some of the issues fixed in this update allow for remote code execution,
which takes place in the context of the logged-in user.
User education is the best defense as we have all seen how
easy it can be to trick users into visiting malicious websites.
Vulnerability Items :
Redirect Cross-Domain Information Disclosure Vulnerability - CVE-2006-3280:
HTML Layout and Positioning Memory Corruption Vulnerability - CVE-2006-3450:
CSS Memory Corruption Vulnerability - CVE-2006-3451:
HTML Rendering Memory Corruption Vulnerability - CVE-2006-3637:
COM Object Instantiation Memory Corruption Vulnerability - CVE-2006-3638:
Source Element Cross-Domain Vulnerability - CVE-2006-3639:
Window Location Information Disclosure Vulnerability - CVE-2006-3640:
FTP Server Command Injection Vulnerability - CVE-2004-1166:
Affected Software:
| • |
Microsoft Windows 2000 Service
Pack 4 |
| • |
Microsoft Windows XP Service
Pack 1 and Microsoft Windows XP Service Pack 2 |
| • |
Microsoft Windows XP Professional
x64 Edition |
| • |
Microsoft Windows Server 2003
and Microsoft Windows Server 2003 Service Pack 1 |
| • |
Microsoft Windows Server 2003
for Itanium-based Systems and Microsoft Windows Server
2003 with SP1 for Itanium-based Systems |
| • |
Microsoft Windows Server 2003
x64 Edition |
|
