Sicherheitslücke in allen Versionen von Windows entdeckt

Sonntag, 01. Sep. 2002 12:25 - [al] - Quelle:

Microsoft hat eine Warnung herausgegeben, das eine als "kritisch" eingestufte Sicherheitslücke schon seit der Version 98 besteht. Um diese Lücke zu stopfen hat Microsoft schnell gehandelt und einen Sicherheitspatch für alle betroffenen Windowsversionen herausgebracht.

Hier ein Auszug der Beschreibung der Sicherheitslücke: The control contains a flaw that could enable a web page, through an extremely complex process, to invoke the control in a way that would delete certificates on a user�s system. An attacker who successfully exploited the vulnerability could corrupt trusted root certificates, EFS encryption certificates, email signing certificates, and any other certificates on the system, thereby preventing the user from using these features. An attack could be carried out through either of two scenarios. The attacker could create a web page the that exploits the vulnerability, and host it on a web site in order to attack users who visited the site. The attacker also could send the page as an HTML mail in order to attack the recipient. Die Angriffgefahr stuft Microsoft so ein: The web site-based attack vector could not be exploited if ActiveX controls were disabled in the Security Zone associated with the attacker�s site. The mail-based attack vector could not be exploited if the recipient�s email client handles HTML mail in the Restricted Sites Zone. Outlook Express 6 and Outlook 2002 open mail in this zone by default. Outlook 98 and 2000 open HTML mail in the Restricted Sites Zone if the Outlook Email Security Update has been installed. The vulnerability would not enable certificates on smart cards to be corrupted, even if the smart card were in the system at the time of an attack. Den Patch für die deutsche Versionen können Sie hier für die folgenden Betriebssysteme herunterladen:

Microsoft Windows 98

Microsoft Windows 98 Second Edition

Microsoft Windows Me

Microsoft Windows NT 4.0

Microsoft Windows NT 4.0, Terminal Server Edition

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows XP 64-bit Edition Aber auch das Microsoft-Update wurde auf den neuesten Stand gebracht.

Diese News jetzt kommentieren

Download Accelerator Plus 5.3...HardTecs4U: Zwei neue Tests...