MS Partner logo

Added support for December 2009 Microsoft security updates

The information in this article applies to:

  • GFI LANguard 9.0
  • GFI LANguard Network Security Scanner 8

Article ID: KBID003699

Query keywords: Patch Detection update, Security Updates

Support for the following Microsoft security updates have been released by GFI for GFI LANguard.
These updates will be automatically downloaded and added to your security vulnerability scanning database on your next restart of GFI LANguard.


New Security Updates Supported:

  • MS09-074 - Vulnerability in Microsoft Office Project Could Allow Remote Code Execution (967183)
  • MS09-073 - Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution (975539)
  • MS09-072 - Cumulative Security Update for Internet Explorer (976325)
  • MS09-071 - Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution (974318)
  • MS09-070 - Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution (971726)
  • MS09-069 - Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (974392)


More Information:

MS09-074
Severity Rating: Critical
Vulnerability in Microsoft Office Project Could Allow Remote Code Execution (967183)

Description:

This security update resolves a privately reported vulnerability in Microsoft Office Project. The vulnerability could allow remote code execution if a user opens a specially crafted Project file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for Microsoft Project 2000 Service Release 1 and rated Important for Microsoft Project 2002 Service Pack 1, and Microsoft Office Project 2003 Service Pack 3.

Included Updates:

  • Security Update for Microsoft Office Project 2003 (KB961082)
  • Security Update for Microsoft Project 2002 (KB961079)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-074.mspx


MS09-073
Severity Rating: Important
Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution (975539)

Description:

This security update resolves a privately reported vulnerability in Microsoft WordPad and Microsoft Office text converters. The vulnerability could allow remote code execution if a specially crafted Word 97 file is opened in WordPad or Microsoft Office Word. An attacker who successfully exploited this vulnerability could gain the same privileges as the user. Users whose accounts are configured to have fewer privileges on the system could be less impacted than users who operate with administrative privileges. This security update is rated Important for WordPad on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. This security update is also rated Important for all supported editions of Microsoft Office Word 2002 and Microsoft Office Word 2003, Microsoft Office Converter Pack, and Microsoft Works 8.5.

Included Updates:

  • Security Update for Microsoft Office 2003 (KB975051)
  • Security Update for Microsoft Office XP (KB975008)
  • Security Update for Microsoft Office 2003 File Converter Pack (KB974882)
  • Security Update for Windows Server 2003 x64 Edition (KB973904)
  • Security Update for Windows XP x64 Edition (KB973904)
  • Security Update for Windows Server 2003 (KB973904)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB973904)
  • Security Update for Windows XP (KB973904)
  • Security Update for Windows 2000 (KB973904)
  • Security Update for Microsoft Works 8 (KB977304)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-073.mspx


MS09-072
Severity Rating: Critical
Cumulative Security Update for Internet Explorer (976325)

Description:

This security update resolves four privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. An ActiveX control built with Microsoft Active Template Library (ATL) headers could also allow remote code execution. This security update is rated Critical for all supported releases of Internet Explorer: Internet Explorer 5.01, Internet Explorer 6, Internet Explorer 6 Service Pack 1, Internet Explorer 7 (except when running on supported editions of Windows Server 2003 and Windows Server 2008), and Internet Explorer 8 (except when running on supported editions of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2). For Internet Explorer 7 and Internet Explorer 8 running on Windows servers as listed, this update is rated Moderate.

Included Updates:

  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2008 R2 for Itanium-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows XP (KB976325)
  • Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB976325)
  • Cumulative Security Update for Internet Explorer 5.01 Service Pack 4 (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2008 R2 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2008 (KB976325)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 for Itanium-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows 7 for x64-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Vista (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 for Itanium-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows XP (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Server 2008 (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows Server 2003 (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows 7 (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows XP x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Vista for x64-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 (KB976325)
  • Cumulative Security Update for Internet Explorer 6 for Windows XP (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 for Itanium-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Vista (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Vista for x64-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2008 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Server 2003 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 6 for Windows XP x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Vista for x64-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows XP (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows XP x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Server 2008 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Vista (KB976325)
  • Cumulative Security Update for Internet Explorer 7 for Windows Server 2008 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 for Itanium-based Systems (KB976325)
  • Cumulative Security Update for Internet Explorer 8 Dynamic Installer for Windows Server 2003 (KB976325)
  • Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 (KB976325)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows XP x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 7 Dynamic Installer for Windows XP (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows XP x64 Edition (KB976325)
  • Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 x64 Edition (KB976325)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-072.mspx


MS09-071
Severity Rating: Critical
Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution (974318)

Description:

This security update resolves two privately reported vulnerabilities in Microsoft Windows. These vulnerabilities could allow remote code execution if messages received by the Internet Authentication Service server are copied incorrectly into memory when handling PEAP authentication attempts. An attacker who successfully exploited either of these vulnerabilities could take complete control of an affected system. Servers using Internet Authentication Service are only affected when using PEAP with MS-CHAP v2 authentication. This security update is rated Critical for Windows Server 2008 for 32-bit Systems Service Pack 2 and Windows Server 2008 for x64-based Systems Service Pack 2. The security update addresses the vulnerabilities by correcting the way Internet Authentication Service validates authentication requests by PEAP clients.

Included Updates:

  • Security Update for Windows Server 2008 for Itanium-based Systems (KB974318)
  • Security Update for Windows Vista for x64-based Systems (KB974318)
  • Security Update for Windows Vista (KB974318)
  • Security Update for Windows Server 2003 x64 Edition (KB974318)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB974318)
  • Security Update for Windows 2000 (KB974318)
  • Security Update for Windows XP (KB974318)
  • Security Update for Windows XP x64 Edition (KB974318)
  • Security Update for Windows Server 2008 (KB974318)
  • Security Update for Windows Server 2008 x64 Edition (KB974318)
  • Security Update for Windows Server 2003 (KB974318)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-071.mspx


MS09-070
Severity Rating: Important
Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution (971726)

Description:

This security update resolves two privately reported vulnerabilities in Microsoft Windows. The more severe of these vulnerabilities could allow remote code execution if an attacker sent a specially crafted HTTP request to an ADFS-enabled Web server. An attacker would need to be an authenticated user in order to exploit either of these vulnerabilities. This security update is rated Important for affected releases of Windows Server 2003, Windows Server 2003 x64 Edition, Windows Server 2008, and Windows Server 2008 x64 Edition.

Included Updates:

  • Security Update for Windows Server 2003 (KB971726)
  • Security Update for Windows Server 2003 x64 Edition (KB971726)
  • Security Update for Windows Server 2008 (KB971726)
  • Security Update for Windows Server 2008 x64 Edition (KB971726)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-070.mspx


MS09-069
Severity Rating: Important
Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (974392)

Description:

This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow a denial of service if a remote, authenticated attacker, while communicating through Internet Protocol security (IPsec), sends a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS) on an affected system. This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

Included Updates:

  • Security Update for Windows 2000 (KB974392)
  • Security Update for Windows Server 2003 for Itanium-based Systems (KB974392)
  • Security Update for Windows Server 2003 (KB974392)
  • Security Update for Windows XP (KB974392)
  • Security Update for Windows XP x64 Edition (KB974392)
  • Security Update for Windows Server 2003 x64 Edition (KB974392)

Link:
http://www.microsoft.com/technet/security/Bulletin/MS09-069.mspx


Note