Windows 7 - Security Bulletins for May 2007

Asked By Donna Buenaventura

08-May-07 01:37 PM

Microsoft has released the following security bulletins today:

MS07-023 -  Vulnerabilities in Microsoft Excel Could Allow Remote Code
Execution (934233)
http://www.microsoft.com/technet/security/Bulletin/MS07-023.mspx
--  Affected Software: Office 2000, Excel 2000, Office XP, Excel 2002,
Office 2003, Excel 2003, Excel Viewer 2003, Office System 2007, Excel 2007,
Office 2004 for Macintosh

MS07-024 -  Vulnerabilities in Microsoft Word Could Allow Remote Code
Execution (934232)
http://www.microsoft.com/technet/security/Bulletin/MS07-024.mspx
-- Affected Software: Office 2000, Word 2000, Office XP, Word 2002, Office
2003, Word 2003, Word Viewer 2003, Office 2004 for Macintosh, Works 2004,
Works 2005, Works 2006

MS07-025 -  Vulnerability in Microsoft Office Could Allow Remote Code
Execution (934873)
http://www.microsoft.com/technet/security/Bulletin/MS07-025.mspx
-- Affected Software: Office 2000, Excel 2000, FrontPage 2000, Publisher
2000, Office XP, Excel 2002, FrontPage 2002, Publisher 2002, Office 2003,
Excel 2003, FrontPage 2003, Publisher 2003, Excel Viewer 2003, Office System
2007, Excel 2007, Publisher2007, SharePoint Designer 2007, Expression Web,
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007
File Formats , Office 2004 for Macintosh

MS07-026 -  Vulnerabilities in Microsoft Exchange Could Allow Remote Code
Execution (931832)
http://www.microsoft.com/technet/security/Bulletin/MS07-026.mspx
-- Affected Software: Exchange 2000 Server, Exchange Server 2003, Exchange
Server 2007

MS07-027 -  Cumulative Security Update for Internet Explorer (931768)
http://www.microsoft.com/technet/security/Bulletin/MS07-027.mspx
-- Affected Software: Windows 2000 Server, Windows 2000 Professional,
Windows 2000 Datacenter Server, Windows 2000 Advanced Server, Windows XP
Home Edition, Windows XP Professional, Windows XP Professional 64-Bit
Edition, Windows Server 2003 for Small Business Server, Windows Server 2003,
Datacenter Edition, Windows Server 2003, Enterprise Edition, Windows Server
2003, Standard Edition, Windows Server 2003, Web Edition, Windows Server
2003 Datacenter Edition for Itanium-based Systems, Windows Server 2003
Enterprise Edition for Itanium-based Systems, Internet Explorer 5.01,
Windows Server 2003 Datacenter x64 Edition, Windows Server 2003 Enterprise
x64 Edition, Windows Server 2003 Standard x64 Edition, Windows Vista,
Windows Vista x64, Internet Explorer 6.0, Internet Explorer 6.0 for Windows
XP Service Pack 2, Internet Explorer 6 for Microsoft Windows XP Professional
x64 Edition, Internet Explorer 6.0 for Windows Server 2003, Internet
Explorer 6 for Microsoft Windows Server 2003 x64 Edition, Internet Explorer
6 for Microsoft Windows Server 2003 for Itanium-based Systems, Internet
Explorer 7.0 for Windows XP Service Pack 2 , Internet Explorer 7.0 For
Windows 2003, Internet Explorer 7 for Windows 2003 for Itanium, Internet
Explorer 7 for Windows 2003 x64 Edition, Internet Explorer 7.0 for Windows
Vista, Internet Explorer 7.0 for Windows Vista x64

MS07-028 -  Vulnerability in CAPICOM Could Allow Remote Code Execution
(931906)
http://www.microsoft.com/technet/security/Bulletin/MS07-028.mspx
-- Affected Software: CAPICOM, Platform SDK Redistrubutable: CAPICOM,
BizTalk Server 2004

MS07-029 - Vulnerability in Windows DNS RPC Interface Could Allow Remote
Code Execution (935966)
http://www.microsoft.com/technet/security/Bulletin/MS07-029.mspx
-- Affected Software: Windows 2000 Server, Windows 2000 Professional,
Windows 2000 Datacenter Server, Windows 2000 Advanced Server, Windows Server
2003 for Small Business Server, Windows Server 2003, Datacenter Edition,
Windows Server 2003, Enterprise Edition, Windows Server 2003, Standard
Edition, Windows Server 2003, Web Edition, Windows Server 2003 Datacenter
Edition for Itanium-based Systems, Windows Server 2003 Enterprise Edition
for Itanium-based Systems, Windows Server 2003 Datacenter x64 Edition,
Windows Server 2003 Enterprise x64 Edition, Windows Server 2003 Standard x64
Edition

Don't forget to read the CAVEATS in each security bulletins (if any).

References:
MS Security Bulletins for end-users:
http://www.microsoft.com/athome/security/update/bulletins/200705.mspx
MS Security Bulletins for IT Pro:
http://www.microsoft.com/technet/security/bulletin/ms07-may.mspx
MS Response Center Blog: http://blogs.technet.com/msrc/default.aspx

Please note, Microsoft NEVER send security updates via e-mail. Download the
updates only from the vendors website - visit Windows Update and Office
Update or Microsoft Update websites. You may also get the updates thru
Automatic Updates functionality in Windows system.

Webcast:
Microsoft will host a webcast tomorrow. The webcast focuses on addressing
your questions and concerns about the security bulletins. Therefore, most of
the live webcast is aimed at giving you the opportunity to ask questions and
get answers from their security experts.
Start Date: Wednesday, May 09, 2007 11:00 AM Pacific Time (US & Canada)
Presenters: Christopher Budd, CCE, CISA, CISM, CISSP, ISSMP Security Program
Manager, Microsoft Corporation and Mike Reavey, Lead Security Program
Manager, Microsoft Corporation
http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032327015&EventCategory=4&culture=en-US&CountryCode=US

Tool:
Check your system for missing or misconfigured patches using Microsoft
Baseline Security Analyzer (MBSA)
http://www.microsoft.com/technet/security/tools/mbsahome.mspx

Support:
Call Microsoft at 1-866-PCSAFETY for issues on security patches if you are
in the US and Canada. For other location, go here:
http://support.microsoft.com/common/international.aspx

--
Regards,
Donna Buenaventura
Windows Security MVP
w: http://cou.dozleng.com
b: http://msmvps.com/donna

08-May-07 01:53 PM

Maybe in a few hours they will do that, but right now many of the links in
your post get me nothing.

08-May-07 01:59 PM

Also:
Non-Security, High-Priority Updates on MU, WU, WSUS and SUS

*  Microsoft has released six non-security, high-priority updates on
Microsoft Update (MU) and Windows Server Update Services (WSUS).
*  Microsoft has released one non-security, high-priority update for Windows
on Windows Update (WU) and Software Update Services (SUS).

Note that this information pertains only to non-security, high-priority
updates on Microsoft Update, Windows Update, Windows Server Update Services,
and Software Update Services released on the same day as the security
bulletin summary. Information will not be provided about non-security
updates released on other days.

08-May-07 02:55 PM

All links are online now except the MS Security Bulletins for end-users:
http://www.microsoft.com/athome/security/update/bulletins/200705.mspx which
is change now to
http://www.microsoft.com/protect/computer/updates/bulletins/200705.mspx

Donna

08-May-07 04:59 PM

Hi Donna,

It would be nice if you could list the URLs and KB numbers for the
non-security updates each month too.



--
Gerry Hickman (London UK)

08-May-07 09:40 PM

Hi,

That's going to be tough because non-security updates usually don't show up
but there's other method to get them:
1.  Go to Microsoft Update - it should detect if a system requires update
(whether it's a security update or not)
2.  Go to Downloads page - http://www.microsoft.com/download and simply hit
date".  All updates that is ready or just released should be at the top
3.  Calendar of Updates (site I own but maintain by volunteers)
http://cou.dozleng.com - we post the updates whether high or non-high as we
find them.
4.  There is feeds for all downloads as soon as it is ready:
http://www.thundermain.com/rss/

Regards,

Donna

08-May-07 05:38 PM

Donna, a dumb question, I guess.

I have Office Standard 2003 installed, minus Outlook.  However, I keep
getting updates for the Outlook junk box filter and another security thing
for Outlook.  Should I disregard these or should I install them anyway?  If
I don't have Outlook installed, why do I get updates for it?  Help!!
Thanks.

EW

08-May-07 05:49 PM

I have Office 2003 without Outlook, and have always been asked to download
the Junk Filter.  I uncheck it.

I also had a lot of updates for Office 2007 today, and I do not have it
installed.

Tom
If

08-May-07 05:59 PM

Thanks Tom.  I uncheck and HIDE the Outlook updates but they keep coming
back!!  Oh well.  BTW, I didn't install Outlook because it can't work with
my free Hotmail account.  I'll just wait until the new Windows Live Mail
client (which is supposed to be similar to Outlook Express) comes out.

EW

11-May-07 09:55 AM

I don't think it's possible to permanently hide all junk mail filter updates
because each month, MS releases it with different KB article.

You should be able to permanently hide other Outlook updates that you do not
need or each of them by going to Microsoft Update website, select 'Custom'
scan then click 'hide' box.  Doing that will stop it in being offered.

Donna