Microsoft released one security bulletin affecting all versions of Windows. MS10-001 addresses one vulnerability in the Embedded OpenType Font Engine and is Critical on Windows 2000. For all other versions of Windows, the vulnerability gets a Low rating.
Microsoft designated the bulletin an aggregate rating of “2” on the Exploitability Index as it applies to Windows 2000 systems. All other systems are rated “3”.
According to the MSRC blog:
Critical:"The vulnerable code is present on newer operating systems but through the Security Development Lifecycle (SDL), there are several mitigations in place that help prevent the likelihood of exploitation. Our Security Research & Defense (SRD) team has a great write up on this in their blog. We do recommend that customers evaluate and deploy this update as soon as possible. Especially those on Windows 2000."
MS10-001 --Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution (972270)
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font in client applications that can render EOT fonts, such as Microsoft Internet Explorer, Microsoft Office PowerPoint, or Microsoft Office Word. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
References:
- MSRC: January 2010 Security Bulletin Release
- TechNet: Microsoft Security bulletin summary for January 2010
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...
No comments:
Post a Comment