Added support for April 2009 Microsoft security updates

The information in this article applies to:

  • GFI LANguard 9.0
  • GFI LANguard Network Security Scanner 8

Article ID: KBID003523

Query keywords: Patch Detection update, Security Updates

Support for the following Microsoft security updates have been released by GFI for GFI LANguard.
These updates will be automatically downloaded and added to your security vulnerability scanning database on your next restart of GFI LANguard.


New Security Updates Supported:

  • MS09-016 - Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (961759)
  • MS09-015 - Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426)
  • MS09-014 - Cumulative Security Update for Internet Explorer (963027)
  • MS09-013 - Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
  • MS09-012 - Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
  • MS09-011 - Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373)
  • MS09-010 - Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)
  • MS09-009 - Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)


More Information:

MS09-016
Severity Rating: Important
Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (961759)

Description:

This security update resolves a privately reported vulnerability and a publicly disclosed vulnerability in Microsoft Internet Security and Acceleration (ISA) Server and Microsoft Forefront Threat Management Gateway (TMG), Medium Business Edition (MBE). These vulnerabilities could allow denial of service if an attacker sends specially crafted network packages to the affected system, or information disclosure or spoofing if a user clicks on a malicious URL or visits a Web site that contains content controlled by the attacker. This security update is rated Important for Forefront TMG MBE, ISA Server 2004, and ISA Server 2006.

Included Updates:

  • Security Update for Forefront Threat Management Gateway, Medium Business Edition (KB 968075)
  • Security Update for ISA Server 2006 RTM (KB 968078)
  • Security Update for ISA Server 2006 SP1 (KB 968078)
  • Security Update for ISA Server 2006 Supportability Pack (KB 968078)
  • Security Update for ISA Server 2004 Standard Edition (KB 960995)
  • Security Update for ISA Server 2004 Enterprise Edition (KB 960995)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-016.mspx


MS09-015
Severity Rating: Moderate
Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426)

Description:

This security update resolves a publicly disclosed vulnerability in the Windows SearchPath function that could allow elevation of privilege if a user downloaded a specially crafted file to a specific location, then opened an application that could load the file under certain circumstances. This security update is rated Moderate for all supported editions of Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. On Microsoft Windows 2000, this update is only classified as a defense-in-depth change.

Included Updates:

  • Security Update for Windows Vista for x64-based Systems (KB959426)
  • Security Update for Windows Vista (KB959426)
  • Security Update for Windows Server 2008 x64 Edition (KB959426)
  • Security Update for Windows Server 2008 for Itanium-based Systems (KB959426)
  • Security Update for Windows Server 2008 (KB959426)
  • Security Update for Windows XP x64 Edition (KB959426)
  • Security Update for Windows XP (KB959426)
  • Security Update for Windows Server 2003 x64 Edition (KB959426)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB959426)
  • Security Update for Windows Server 2003 (KB959426)
  • Security Update for Windows 2000 (KB959426)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-015.mspx


MS09-014
Severity Rating: Critical
Cumulative Security Update for Internet Explorer (963027)

Description:

This security update resolves four privately reported vulnerabilities and two publicly disclosed vulnerabilities in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer or if a user connects to an attacker's server by way of the HTTP protocol. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for Internet Explorer 5.01 and Internet Explorer 6 Service Pack 1, running on supported editions of Microsoft Windows 2000; Internet Explorer 6 and Internet Explorer 7 running on supported editions of Windows XP; and Internet Explorer 7 running on supported editions of Windows Vista. For Internet Explorer 6 and Internet Explorer 7 running on supported editions of Windows Server 2003 and Windows Server 2008, this security update is rated Important.

Included Updates:

  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows XP (KB963027)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 (KB963027)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows XP x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 for Itanium-based Systems (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows XP x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows XP (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 for Itanium-based Systems (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 (KB963027)
  • Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB963027)
  • Cumulative Security Update for Internet Explorer 6 for Windows XP x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 6 for Windows XP (KB963027)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 x64 Edition (KB963027)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 for Itanium-based Systems (KB963027)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 (KB963027)
  • Cumulative Security Update for Internet Explorer 5.01 Service Pack 4 (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Vista x64-based Systems (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Vista (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 for Itanium-based Systems (KB963027)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 x64 Edition (KB963027)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-014.mspx


MS09-013
Severity Rating: Critical
Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)

Description:

This security update resolves one publicly disclosed vulnerability and two privately reported vulnerabilities in Microsoft Windows HTTP Services (WinHTTP). The most severe vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

Included Updates:

  • Security Update for Windows XP x64 Edition (KB960803)
  • Security Update for Windows XP (KB960803)
  • Security Update for Windows Server 2003 x64 Edition (KB960803)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB960803)
  • Security Update for Windows Server 2003 (KB960803)
  • Security Update for Windows 2000 (KB960803)
  • Security Update for Windows Server 2008 (KB960803)
  • Security Update for Windows Vista (KB960803)
  • Security Update for Windows Server 2008 x64 Edition (KB960803)
  • Security Update for Windows Server 2008 for Itanium-based Systems (KB960803)
  • Security Update for Windows Vista for x64-based Systems (KB960803)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-013.mspx


MS09-012
Severity Rating: Important
Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)

Description:

This security update resolves four publicly disclosed vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker is allowed to log on to the system and then run a specially crafted application. The attacker must be able to run code on the local machine in order to exploit this vulnerability. An attacker who successfully exploited any of these vulnerabilities could take complete control over the affected system. This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

Included Updates:

  • Security Update for Windows XP x64 Edition (KB952004)
  • Security Update for Windows XP (KB952004)
  • Security Update for Windows Server 2003 x64 Edition (KB952004)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB952004)
  • Security Update for Windows Server 2003 (KB952004)
  • Security Update for Windows 2000 (KB952004)
  • Security Update for Windows Server 2008 for Itanium-based Systems (KB952004)
  • Security Update for Windows Server 2008 x64 Edition (KB952004)
  • Security Update for Windows Vista for x64-based Systems (KB952004)
  • Security Update for Windows Server 2008 (KB952004)
  • Security Update for Windows Vista (KB952004)
  • Security Update for Windows XP x64 Edition (KB956572)
  • Security Update for Windows XP (KB956572)
  • Security Update for Windows Server 2003 x64 Edition (KB956572)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB956572)
  • Security Update for Windows Server 2003 (KB956572)
  • Security Update for Windows Vista for x64-based Systems (KB956572)
  • Security Update for Windows Server 2008 for Itanium-based Systems (KB956572)
  • Security Update for Windows Server 2008 x64 Edition (KB956572)
  • Security Update for Windows Server 2008 (KB956572)
  • Security Update for Windows Vista (KB956572)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-012.mspx


MS09-011
Severity Rating: Critical
Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373)

Description:

This security update resolves a privately reported vulnerability in Microsoft DirectX. The vulnerability could allow remote code execution if user opened a specially crafted MJPEG file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

Included Updates:

  • Security Update for Windows XP x64 Edition (KB961373)
  • Security Update for Windows XP (KB961373)
  • Security Update for Windows Server 2003 x64 Edition (KB961373)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB961373)
  • Security Update for Windows Server 2003 (KB961373)
  • Security Update for DirectX 9 for Windows 2000 (KB961373)
  • Security Update for DirectX 8 for Windows 2000 (KB961373)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-011.mspx


MS09-010
Severity Rating: Critical
Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)

Description:

This security update resolves two publicly disclosed vulnerabilities and two privately reported vulnerabilities in Microsoft WordPad and Microsoft Office text converters. The vulnerabilities could allow remote code execution if a specially crafted file is opened in WordPad or Microsoft Office Word. Do not open Microsoft Office, RTF, Write, or WordPerfect files from untrusted sources using affected versions of WordPad or Microsoft Office Word. This security update is rated Critical for supported editions of Microsoft Office Word 2000. This security update is also rated Important for supported editions of Microsoft Office Word 2002; Microsoft Office Converter Pack; and WordPad on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

Included Updates:

  • Security Update for Windows XP x64 Edition (KB923561)
  • Security Update for Windows XP (KB923561)
  • Security Update for Windows Server 2003 x64 Edition (KB923561)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB923561)
  • Security Update for Windows Server 2003 (KB923561)
  • Security Update for Windows 2000 (KB923561)
  • Security Update for Office XP (KB933399)
  • Security Update for Microsoft Office File Converter Pack 2003 (KB960476)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-010.mspx


MS09-009
Severity Rating: Critical
Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)

Description:

This security update resolves a privately reported and a publicly disclosed vulnerability. The vulnerabilities could allow remote code execution if the user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for all supported editions of Microsoft Office Excel 2000. For all supported editions of Microsoft Office Excel 2002, Microsoft Office Excel 2003, Microsoft Office Excel 2007, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; all supported versions of Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack Service Pack 1, this security update is rated Important.

Included Updates:

  • Security Update for Microsoft Office Excel Viewer (KB960000)
  • Security Update for Microsoft Office Excel Viewer 2003 (KB959993)
  • Security Update for 2007 Microsoft Office System (KB960003)
  • Security Update for Microsoft Office Excel 2007 (KB959997)
  • Security Update for Microsoft Office Excel 2003 (KB959995)
  • Security Update for Microsoft Excel 2002 (KB959988)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-009.mspx


Note