[SECURITY-L] CAIS-Alerta: Correcoes de seguranca acumulativas para Internet Explorer (MS05-014)

Ter Fev 15 09:00:38 -02 2005

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Correcoes de seguranca acumulativas para Internet
 Explorer (MS05-014)
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Fri, 11 Feb 2005 15:02:55 -0200 (BRDT)

-----BEGIN PGP SIGNED MESSAGE-----

Prezados,

O CAIS esta' repassando o alerta da Microsoft, intitulado "MS05-014 - 
Cumulative Security Update for Internet Explorer (867282)", que trata de 
um conjunto de correcoes de vulnerabilidades para o Microsoft Internet 
Explorer.

Caso um usuario esteja registrado no sistema com privilegios 
administrativos, um atacante que consiga explorar alguma destas 
vulnerabilidades podera obter o controle completo sobre o sistema afetado, 
sendo capaz de instalar programas, adicionar novas contas de usuarios com 
privilegios totais no sistema e ate' mesmo ver, modificar ou apagar dados 
no sistema vulneravel.

Sistemas afetados:

. Microsoft Windows 2000 Service Pack 3
. Microsoft Windows 2000 Service Pack 4
. Microsoft Windows XP Service Pack 1
. Microsoft Windows XP Service Pack 2
. Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
. Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
. Microsoft Windows Server 2003
. Microsoft Windows Server 2003 for Itanium-based Systems
. Microsoft Windows 98
. Microsoft Windows 98 Second Edition (SE)
. Microsoft Windows Millennium Edition (ME)

Componentes afetados:

. Internet Explorer 5.01 Service Pack 3 (SP3) instalado em Windows 2000 Service Pack 3
. Internet Explorer 5.01 Service Pack 4 instalado em Windows 2000 Service Pack 4 
. Internet Explorer 5.5 Service Pack 2 instalado em  Microsoft Windows Millennium Edition
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 2000 Service Pack 3
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 2000 Service Pack 4
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows XP Service Pack 1
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 98
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 98 SE
. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows Millennium Edition
. Internet Explorer 6 para Windows XP Service Pack 1 (64-Bit Edition)
. Internet Explorer 6 para Windows Server 2003
. Internet Explorer 6 para Windows Server 2003 64-Bit Edition
. Internet Explorer 6 para Windows XP 64-Bit Edition Version 2003
. Internet Explorer 6 para Windows XP Service Pack 2

Correcoes disponiveis:

Recomenda-se fazer a atualizacao para as versoes disponiveis em:

. Internet Explorer 5.01 Service Pack 3 (SP3) instalado em Windows 2000 Service Pack 3                                                      
  http://www.microsoft.com/downloads/details.aspx?FamilyId=34F5BCDE-4EE2-4EFD-BB60-F5A6BC5F56D1  

. Internet Explorer 5.01 Service Pack 4 instalado em Windows 2000 Service Pack 4   
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2CBB4B-2F00-4CD6-BB98-AD14A48B53C0

. Internet Explorer 5.5 Service Pack 2 instalado em Microsoft Windows Millennium Edition
  Veja a sessao FAQ do boletim original, encontrado na sessao "Mais Informacoes", para detalhes sobre este sistema operacional.    

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 2000 Service Pack 3                    
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E473CD05-3320-4322-B437-F3A61E62F567

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 2000 Service Pack 4
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E473CD05-3320-4322-B437-F3A61E62F567

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows XP Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E473CD05-3320-4322-B437-F3A61E62F567

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 98                                                                        
  Veja a sessao FAQ do boletim original, encontrado na sessao "Mais Informacoes", para detalhes sobre este sistema operacional.

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows 98 SE
  Veja a sessao FAQ do boletim original, encontrado na sessao "Mais Informacoes", para detalhes sobre este sistema operacional.

. Internet Explorer 6 Service Pack 1 instalado em Microsoft Windows Millennium Edition 
  Veja a sessao FAQ do boletim original, encontrado na sessao "Mais Informacoes", para detalhes sobre este sistema operacional.

. Internet Explorer 6 para Windows XP Service Pack 1 (64-Bit Edition) 
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7EAE62C0-3DA0-4BAC-B2FE-ECE89959053D

. Internet Explorer 6 para Windows Server 2003                                                                                                
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4DC0FE8A-9D03-4AB8-8EAF-C85FF25CB1A2

. Internet Explorer 6 para Windows Server 2003 64-Bit Edition                                                                                 
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E3C4DA1F-6FA2-4A2B-A6D9-24B599C353B3

. Internet Explorer 6 para Windows XP 64-Bit Edition Version 2003                                                                             
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E3C4DA1F-6FA2-4A2B-A6D9-24B599C353B3

. Internet Explorer 6 para Windows XP Service Pack 2                  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=82056EAB-8367-4B04-A11A-1002D14EB55B

Mais informacoes:

. MS05-014 - Cumulative Security Update for Internet Explorer (867282) 
  http://www.microsoft.com/technet/security/bulletin/ms05-014.mspx

. Vulnerability Note VU#823971 - Microsoft Internet Explorer contains a Channel Definition Format (CDF) cross-domain vulnerability
  http://www.kb.cert.org/vuls/id/823971

. Vulnerability Note VU#843771 - Microsoft Internet Explorer contains a DHTML method heap memory corruption vulnerability
  http://www.kb.cert.org/vuls/id/843771

. Vulnerability Note VU#580299 - Microsoft Internet Explorer contains URL decoding zone spoofing vulnerability
  http://www.kb.cert.org/vuls/id/580299

. Vulnerability Note VU#698835 - Microsoft DHTML Drag-and-Drop events insufficiently validated 
  http://www.kb.cert.org/vuls/id/698835

. Microsoft Brasil Security
  http://www.microsoft.com/brasil/security

. Technet Brasil - Central de Seguranca
  http://www.technetbrasil.com.br/seguranca

Identificador CVE (http://cve.mitre.org): CAN-2005-0053, CAN-2005-0054, CAN-2005-0055, CAN-2005-0056

O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.

Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:
http://www.rnp.br/cais/alertas/rss.xml

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQCVAwUBQgzlROkli63F4U8VAQG3NQP7BCWkkG0J12qC4+Qnvx8SVbT6iO9q8mdb
HknEJhNrq1sjH/tO6pZctgcgXcfMX5WSwYrruxcNM0G3yXannk3zHjFsbghDBvoK
sl6PsE5AsYYw9TkYt51yuiFdcnBeqHVulDxhkk65TI5NVtRBkoiwlpwoBfoINCTH
Lo/RC7wBXKE=
=lHGO
-----END PGP SIGNATURE-----

----- End forwarded message -----