• IDP Daily Update #1312
  posted: 11/18/08
  
• NSM Daily Update #1312
  posted: 11/18/08
  
• Deep Inspection 5.3r5 and above, 5.4, 6.0 #1312
  posted: 11/18/08
  
• Deep Inspection 5.1, 5.2, 5.3r4 and below #1300
  posted: 11/18/08
  
• Deep Inspection 5.0 #1132
  posted: 04/01/08
  
• Antivirus
  posted: 11/17/08

Text Size:        

• See Also
• Current Updates

• Microsoft Security Resources
• Security Incidents
• Security Resources

• Juniper Networks Product Solutions for Microsoft
• Get detailed information about Juniper solutions that protect your Microsoft environment:
• SSL VPNs
• Intrusion Prevention
• Firewall / VPN Central Management34 KB
• VPN Resiliency594 KB
• Denial of Service and Attack Prevention754 KB
• Antivirus Protection55 KB

February 2005

---

Prior Updates:

---

Login to learn more about how Juniper Networks products can protect you from these vulnerabilities. (If you don't already have a login, see Requesting Support.)

February 2005

Microsoft Security Bulletin MS05-004

ASP.NET Path Validation Vulnerability (887219)

Severity: Important
Vulnerabilities:

• Path Validation Vulnerability - CAN-2004-0847
  A canonicalization vulnerability exists in ASP.NET that could allow an attacker to bypass the security of an ASP.NET Web site and gain unauthorized access. An attacker who successfully exploited this vulnerability could take a variety of actions, depending on the specific contents of the website.

Microsoft Security Bulletin MS05-005

Vulnerability in Microsoft Office XP could lead to Buffer Overrun (873352)

Severity: Critical
Vulnerabilities:

• Buffer Overrun in Microsoft Office XP Vulnerability - CAN-2004-0848
  A vulnerability exists in Microsoft Office XP that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could take complete control of the affected system.

Microsoft Security Bulletin MS05-006

Vulnerability in Windows SharePoint Services and SharePoint Team Services Could Allow Cross-Site Scripting and Spoofing Attacks (887981)

Severity: Moderate
Vulnerabilities:

• Cross-site Scripting and Spoofing Vulnerability - CAN-2005-0049
  This is a cross-site scripting and spoofing vulnerability. The cross-site scripting vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts to exploit this vulnerability require user interaction. This vulnerability could allow an attacker access to any data on the affected systems that was accessible to the individual user. It may also be possible for an attacker to exploit this vulnerability to modify Web browser caches and intermediate proxy server caches, and put spoofed content in those caches.

Microsoft Security Bulletin MS05-007

Vulnerability in Windows Could Allow Information Disclosure (888302)

Severity: Important
Vulnerabilities:

• Named Pipe Vulnerability - CAN-2005-0051
  This is an information disclosure vulnerability. An attacker who successfully exploited this vulnerability could remotely read the user names for users who have an open connection to an available shared resource.

Microsoft Security Bulletin MS05-008

Vulnerability in Windows Shell Could Allow Remote Code Execution (890047)

Severity: Important
Vulnerabilities:

• Drag-and-Drop Vulnerability - CAN-2005-0053
  A privilege elevation vulnerability exists in Internet Explorer because of the way that Internet Explorer handles drag-and-drop events. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow an attacker to save a file on the user?s system if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.

Microsoft Security Bulletin MS05-009

Vulnerability in PNG Processing Could Lead to Buffer Overrun (890261)

Severity: Critical
Vulnerabilities:

• PNG Processing Vulnerability in Windows Media Player - CAN-2004-1244
  A buffer overrun vulnerability exists in Windows Media Player because it does not properly handle PNG files with excessive height. An attacker could exploit the vulnerability by constructing a malicious PNG that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
• PNG Processing Vulnerability in Windows Messenger - CAN-2004-0597
  A buffer overrun vulnerability exists in Windows Messenger because it does not properly handle corrupt or malformed PNG. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS05-010

Vulnerability in the License Logging Service Could Allow Code Execution (885834)

Severity: Critical
Vulnerabilities:

• License Logging Service Vulnerability - CAN-2005-0050
  A remote code execution vulnerability exists in the License Logging service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Microsoft Security Bulletin MS05-011

Vulnerability in Server Message Block Could Allow Remote Code Execution (885250)

Severity: Critical
Vulnerabilities:

• Server Message Block Vulnerability - CAN-2005-0045
  A remote code execution vulnerability exists in Server Message Block (SMB) that could allow an attacker who successfully exploited this vulnerable to take complete control of the affected system.

Microsoft Security Bulletin MS05-012

Vulnerability in OLE and COM Could Allow Remote Code Execution (873333)

Severity: Critical
Vulnerabilities:

• COM Structured Storage Vulnerability - CAN-2005-0047
  A privilege elevation vulnerability exists in the way that the affected operating systems and programs access shared memory when the process COM structured storage files. This vulnerability could allow a logged on user to take complete control of the system.
• Input Validation Vulnerability - CAN-2005-0044
  A remote code execution vulnerability exists in OLE because of the way that it handles input validation. An attacker could exploit the vulnerability by constructing a malicious document that could potentially allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability on Windows 2000, Windows XP, and Windows Server 2003.

Microsoft Security Bulletin MS05-013

Vulnerability in the DHTML Editing Component ActiveX Control Could Allow Code Execution (891781)

Severity: Critical
Vulnerabilities:

• DHTML Editing Component ActiveX Control Cross Domain Vulnerability - CAN-2004-1319
  A cross-domain vulnerability exists in the Microsoft Dynamic HTML (DHTML) Editing Component ActiveX control that could allow information disclosure or remote code execution on an affected system. An attacker could exploit the vulnerability by constructing a malicious Web page that could potentially allow remote code execution if a user visited that page. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft Security Bulletin MS05-014

Cumulative Security Update for Internet Explorer (867282)

Severity: Critical
Vulnerabilities:

• Drag-and-Drop Vulnerability - CAN-2005-0053
  A privilege elevation vulnerability exists in Internet Explorer because of the way that Internet Explorer handles drag-and-drop events. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow an attacker to save a file on the user?s system if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.
• URL Decoding Zone Spoofing Vulnerability - CAN-2005-0054
  A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain encoded URLs. An attacker could exploit the vulnerability by constructing a malicious URL. This malicious URL could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message. The URL could be made to look like a link to another Web site in an attempt to trick a user into clicking it. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability.
• DHTML Method Heap Memory Corruption Vulnerability - CAN-2005-0055
  A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain DHTML methods. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.
• Channel Definition Format (CDF) Cross Domain Vulnerability - CAN-2005-0056
  A cross-domain vulnerability exists in Internet Explorer that could allow information disclosure or remote code execution on an affected system. An attacker could exploit the vulnerability by constructing a malicious Web page. The malicious Web page could potentially allow remote code execution if viewed by a user. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability.

Microsoft Security Bulletin MS05-015

Vulnerability in Hyperlink Object Library Could Allow Remote Code Execution (888113)

Severity: Critical
Vulnerabilities:

• Hyperlink Object Library Vulnerability - CAN-2005-0057
  A remote code execution vulnerability exists in the Hyperlink Object Library. This problem exists because of an unchecked buffer while handling hyperlinks. An attacker could exploit the vulnerability by constructing a malicious hyperlink which could potentially lead to remote code execution if a user clicks a malicious link within a Web site or e-mail message. An attacker who successfully exploited this vulnerability could take complete control of the affected system. User interaction is required to exploit this vulnerability.

Microsoft Security Bulletin MS04-035

Vulnerability in SMTP Could Allow Remote Code Execution (885881)

Severity: Critical
Vulnerabilities:

• SMTP Vulnerability - CAN-2004-0840
  A remote code execution vulnerability exists in the Windows Server 2003 SMTP component because of the way that it handles Domain Name System (DNS) lookups. An attacker could exploit the vulnerability by causing the server to process a particular DNS response that could potentially allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. The vulnerability also exists in the Microsoft Exchange Server 2003 Routing Engine component when installed on Microsoft Windows 2000 Service Pack 3 or on Microsoft Windows 2000 Service Pack 4 and in Microsoft Exchange 2000 Server Service Pack 3.