Microsoft Releases 8 'Critical' Security Patches -- Redmondmag.com

Microsoft Releases 8 'Critical' Security Patches

The Redmond software giant released 12 patches -- eight of which are deemed "critical" -- as part of its regularly scheduled monthly security update.

By Becky Nagel
06/13/2006

Microsoft Corp. released 12 patches -- eight of which are deemed "critical" -- as part of its regularly scheduled monthly security update.

Three of the critical patches relate to vulnerabilities in Internet Explorer, while others deal with the Windows operating system, Windows Media Player, Word and PowerPoint flaws. All of the critical patches fix problems that "could allow remote code execution," as the company likes to say.

The critical patches are:

MS06-021, Cumulative Security Update for Internet Explorer: Resolves several vulnerabilities in Internet Explorer that could allow remote code execution, four of which are rated "critical" for IE 6 for Windows XP SP 2 (multiple CVEs). The company recommends reading this Knowledge Base article for known issues with this patch.
MS06-022, Vulnerability in ART Image Rendering Could Allow Remote Code Execution: This update resolves a vulnerability that could allow remote code execution when using Internet Explorer (CVE-2006-2378).
MS06-023, Vulnerability in Microsoft JScript Could Allow Remote Code Execution: Resolves a vulnerability in JScript that could allow remote code execution when using Internet Explorer (CVE-2006-1313). Update should be installed at the same time as MS06-021 above to be effective.
MS06-024, Vulnerability in Windows Media Player Could Allow Remote Code Execution: Deals with Windows Media Player PNG vulnerability CVE-2006-0025.
MS06-025, Vulnerability in Routing and Remote Access Could Allow Remote Code Execution: Fixes Windows vulnerabilities dealing with RRAS memory corruption and RASMAN registry corruption (multiple CVEs).
MS06-026, Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution: Fixes a graphics rendering vulnerability relating to the way Windows handles Windows MetaFile (WMF) graphics (CVE-2006-2376). Microsoft recommends reading this KB article for known issues relating to this patch, although the article does not address those issues at press time.
MS06-027, Vulnerability in Microsoft Word Could Allow Remote Code Execution: Fixes a flaw related to a Word malformed object pointer vulnerability (CVE-2006-2492).
MS06-028, Vulnerability in Microsoft PowerPoint Could Allow Remote Code Execution: Fixes a flaw in PowerPoint that could allow hackers to exploit administrator log-ins (CVE-2006-0022). Critical rating applies to PowerPoint 2000 only -- rated "important" for other versions.

There are also three patches rated "important" and one "moderate." They are:

MS06-029, Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection: Fixes a script injection vulnerability that exists in Exchange Server running Outlook Web Access in which an attacker could exploit via a crafted e-mail message (CVE-2006-1193). Microsoft recommends reading this KB article before installing for known issues with this patch.
MS06-030, Vulnerability in Server Message Block Could Allow Elevation of Privilege: This update resolves several vulnerabilities in Windows that require the attacker to validate logon credentials and be able to log on locally to exploit (multiple CVEs).
MS06-032, Vulnerability in TCP/IP Could Allow Remote Code Execution: Fixes an IP source route vulnerability (CVE-2006-2379). Microsoft recommends reviewing this KB article for known issues with this patch.
MS06-031, Vulnerability in RPC Mutual Authentication Could Allow Spoofing: This moderate-rated vulnerability fixes an issue with the RPC service that could enable an attacker to spoof trusted network resource (CVE-2006-2380).

For more information on all these patches, view the Microsoft Security Bulletin Summary for June 2006 found here.

About the Author

Becky Nagel serves as vice president of AI for 1105 Media specializing in developing media, events and training for companies around AI and generative AI technology. She also regularly writes and reports on AI news, and is the founding editor of PureAI.com. She's the author of "ChatGPT Prompt 101 Guide for Business Users" and other popular AI resources with a real-world business perspective. She regularly speaks, writes and develops content around AI, generative AI and other business tech. Find her on X/Twitter @beckynagel.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.