Advisories

CERT-In Advisory CIAD-2005-0022

Vulnerabilities in Microsoft Windows Components and Internet Explorer

Original Issue Date: October 13, 2005

Severity Rating: High

Systems Affected

Microsoft Windows components and Internet Explorer

Overview

Multiple vulnerabilities have been reported in the Microsoft Windows components and Internet Explorer. This advisory describes these vulnerabilities addressed by the Microsoft Security Bulletins of October 2005.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS05-052:Cumulative Security Update for Internet Explorer	High	CIVN-2005-0095 Microsoft COM Object Instantiation Memory Corruption Vulnerability
MS05-051:Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution	High	CIVN-2005-0096 Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution
MS05-050:Vulnerability in DirectShow Could Allow Remote Code Execution	High	CIVN-2005-0097 Microsoft msdds.dll COM object Vulnerability
MS05-049:Vulnerabilities in Windows Shell Could Allow Remote Code Execution	High	CIVN-2005-0099 Microsoft Windows Shell and WebView Remote Code Execution Vulnerabilities
MS05-046:Vulnerability in Telephony Service Could Allow Remote Code Execution	Medium	CIVN-2005-0098 Vulnerability in the Client Services for Netware
MS05-048:Vulnerability in the Microsoft Collaboration Data Objects Could Allow Remote Code Execution	Medium	CIVN-2005-0102 Microsoft Collaboration Data Objects Buffer Overflow Vulnerability
MS05-047:Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege	Medium	CIVN-2005-0103 Microsoft Windows Plug-and-Play Service Remote Code Execution Vulnerability
MS05-044:Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing	Low	CIVN-2005-0100 File Transfer Location and Tampering Vulnerability in the Windows FTP Client
MS05-045:Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing	Low	CIVN-2005-0101 Denial of Service Vulnerability in Network Connection Manager

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin October 2005
http://www.microsoft.com/technet/security/bulletin/ms05-oct.mspx

Vendor Information

Microsoft Corporation
http://www.microsoft.com/technet/security/bulletin/ms05-oct.mspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India