Hi everyone, Bill Sisk here. This week we became aware of publicly disclosed exploit code being used in limited attacks on customers. This change in the threat landscape has prompted us to update last week’s Security Advisory 943521 and triggered our Software Security Incident Response Plan (SSIRP) . Third party applications are currently being used as the vector for attack and customers who have applied the security updates available from these vendors are currently protected. However, because...

Hi everyone. This is Jonathan from the SWI team in the MSRC. We’ve just released Security Advisory 943521 regarding a vulnerability affecting Windows Server 2003 and Windows XP with Internet Explorer 7 installed. As you have probably noted there’s been a fair amount of discussion on this issue. One of the reasons we are releasing this Advisory is due to increased risk given recent discussions about how this vulnerability could be used in attacks. Another reason is to clear up the confusion we see...

Since this is my first post, I suppose a quick introduction is in order. I’m Bill Sisk, a member of the Security Response Communications Team. My team works to provide communications around security response issues to our customer through MSRC Blogs and other outreach vehicles. As part of that I wanted to let people know that we just posted Microsoft Security Advisory 943521 , which gives additional information about a vulnerability in the way Microsoft Windows XP SP2 and Windows 2003 SP1 and...

Hi Everyone! This is Tami Gallupe , MSRC release manager, and here is a brief update on the bulletins we released today. Today, we released 6 bulletins: 4 have a maximum severity rating of Critical and 2 have a maximum severity rating of Important. The bulletins are as follows: MS07-055 addresses a vulnerability in Kodak Image Viewer, and is rated as a Critical bulletin. MS07-056 addresses a vulnerability Outlook Express and Windows Mail, and is rated as a Critical bulletin...

Hello, This is Christopher Budd. I wanted to let you know that we’ve just posted our Advance Notification for next week’s bulletin release on Tuesday October 9, 2007 at or around 10 a.m. Pacific Time. A reminder that the information we post is intended to help with your planning for next week, but because it is preliminary information it is subject to change. As part of our regularly scheduled bulletin release, we’re currently planning to release seven security bulletins: · Five Microsoft...