U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Alert (TA05-165A)

Microsoft Windows and Internet Explorer Vulnerabilities

Original release date: June 14, 2005

Systems Affected

  • Microsoft Windows
  • Microsoft Internet Explorer
For more complete information, refer to the Microsoft Security Bulletin Summary for June, 2005.

Overview

Microsoft has released updates that address critical vulnerabilities in Windows and Internet Explorer. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service.

Description

Microsoft Security Bulletins for June, 2005 address a number of vulnerabilities in Windows, Internet Explorer, Outlook Express, Outlook Web Access, ISA Server, the Step-by-Step Interactive Training engine, and telnet. Further information about the more serious vulnerabilities is available in the following Vulnerability Notes:

VU#189754 - Microsoft Internet Explorer buffer overflow in PNG image rendering component

A buffer overflow in the PNG image rendering component of Microsoft Internet Explorer may allow a remote attacker to execute code on a vulnerable system.
(CAN-2005-1211)

VU#489397 - Microsoft Server Message Block vulnerable to buffer overflow

Microsoft Server Message Block (SMB) is vulnerable to a buffer handling flaw when processing incoming SMB packets that may lead to remote code execution.
(CAN-2005-1206)

VU#851869 - Microsoft HTML Help input validation error

Microsoft HTML Help fails to properly validate input data, allowing a remote attacker to execute arbitrary code.
(CAN-2005-1208)

Impact

Exploitation of the most serious of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code with SYSTEM privileges. This would allow an attacker to take complete control of a vulnerable system. An attacker could also execute arbitrary code with user privileges, or cause a denial of service.

Solution

Apply updates

Microsoft has provided the patches for these vulnerabilities in the Security Bulletins and on Windows Update.

Workarounds

Please see the individual vulnerability notes for workarounds.


Appendix A. References


Feedback can be directed to the US-CERT Technical Staff

Revision History

  • June 14, 2005: Initial release

    Last updated

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top