Status Tracking Note TRTA07-128A

Microsoft Updates for Multiple Vulnerabilities

Overview

Microsoft has released updates that address critical vulnerabilities in Microsoft Windows, Internet Explorer, Office, Exchange, Cryptographic API Component Object Model (CAPICOM), and BizTalk. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service on a vulnerable system.
Event Information


Date (UTC)Description
2007-05-10 Bugtraq
MS07-027 mdsauth.dll NMSA Session Description Object SaveAs control, arbitrary file modification
Arbitrary File Rewrite Vulnerability Proof Of Concept (CVE-2007-2221, MS07-027)
#Cid: 23827.html
2007-05-09 18:21 Symantec
ThreatCON (2) => (1)
2007-05-09 01:04 JPCERT/CC
JPCERT-AT-2007-0012: May 2007 Microsoft Security Bulletin (seven critical patches)
2007-05-08 20:20 US-CERT
TA07-128A: Microsoft Updates for Multiple Vulnerabilities
Via US-CERT Mailing List
2007-05-08 19:42 Microsoft
Microsoft Security Bulletin MS07-029: Vulnerability in Windows DNS RPC Interface Could Allow Remote Code Execution (935966)
Security Bulletin published.
2007-05-08 18:20 US-CERT
Microsoft Releases May Security Bulletin
Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, Windows DNS RPC Interface, Office, Exchange, CAPICOM, and BizTalk as part of the Microsoft Security Bulletin Summary for May 2007.
2007-05-08 18:00 Symantec
ThreatCON (1) => (2)
2007-05-08 Internet Security Systems
Microsoft Exchange MIME base64 code execution
Microsoft Exchange could allow a remote attacker to execute arbitrary code on the system, caused by improper decoding of MIME base64-encoded content.
2007-05-08 Internet Security Systems
Microsoft Internet Explorer Msauth.dll Code Execution
Microsoft Internet Explorer could allow a remote attacker to execute arbitrary code on the system, caused by a vulnerability in the mdsauth.dll control in Windows Media Server.
2007-05-08 Microsoft
MS07-MAY: Microsoft Security Bulletin Summary for May 2007
Included in this advisory are updates for newly discovered vulnerabilities.
2007-04-12 Microsoft
Microsoft Security Advisory (935964): Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution
DNS RPC Management Vulnerability(CVE-2007-1748)
Advisory published.
2006-11-16 Zero Day Initiative (ZDI)
ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability
Excel BIFF Record Vulnerability(MS07-023, CVE-2007-0215)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. Exploitation requires that the attacker coerce the target into opening a malicious .XLS file.
Vulnerability Reported
2006-10-03 Zero Day Initiative (ZDI)
ZDI-07-027: Microsoft Internet Explorer Table Column Deletion Memory Corruption Vulnerability
Uninitialized Memory Corruption Vulnerability(MS07-027, CVE-2007-0944)
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
Vulnerability Reported


Date first published (UTC): 2007-05-10T09:33+00:00
Date last updated (UTC): 2007-05-13T08:02+00:00