Microsoft Reveals New Holes

Microsoft today revealed details on three new security vulnerabilities in its Windows environment, and users and vendors are scrambling to patch up the holes.

The software giant rated two of the vulnerabilities as "critical": One flaw could allow attackers to execute code remotely via Microsoft Exchange (MS Security Bulletin MS06-019); and a vulnerability in Adobe's Macromedia Flash Player could let outsiders run remote code (MS06-020).

The third threat, which Microsoft rated as "moderate," could allow an attacker to send a specially crafted message that would stop Microsoft's Distributed Transaction Coordinator (MSDTC) from operating, paving the way for a denial-of-service attack (MS06-018.

All three security bulletins can be found here. Microsoft has issued software updates for all three.

As Microsoft scrambled to issue the patches, security vendors stepped forward to offer their own solutions to the vulnerabilities. Most, such as Symantec, issued advisories as usual, but Juniper Networks turned it into a marketing opportunity, telling users its security products had already solved the problem.

Juniper issued a statement to the effect that users of its Juniper Intrusion Detection and Prevention product are safe from the three new threats, even if they haven't installed the patches.

Advisories help users limit the damage caused by newly discovered Windows flaws, but Juniper's approach to the security bulletins represents a type of response that is "becoming vastly more successful'" says Rob Enderle, CEO of the Enderle Group consultancy.

"Juniper basically says, 'If you are using our security solution, you are protected,' " Enderle observed. That may prove a welcome bit of hope to users under constant threat; but the vendor has to deliver more than just words. "This idea that a vendor that has your back should -- if the solutions will hold up to the promise -- result in greater sales for the vendors who demonstrate it."

Enterprises that don't have Juniper's technology can still respond quickly to the problems by applying the three software updates, but the software deployment process often takes time, and leaves a window open for attackers who might exploit the vulnerabilities in the near term.

— Tim Wilson, Site Editor, Dark Reading

Organizations mentioned in this story