June 2005 Security Updates

June 2005’s “Patch Tuesday” included three critical and four important patches for vulnerabilities in Microsoft software. Customers can download the patches from the new Microsoft Update Web site or deploy them with the latest version of Windows Server Update Services (WSUS). But switching from Windows Update to Microsoft Update is not automatic: customers must first review the license agreement and install a new ActiveX control.

June Patches and Tools

The three critical patches all fix vulnerabilities in Windows, including the following:

• A cumulative patch for problems with the display of PNG images and XML content in Internet Explorer
• A patch to provide better validation of input data in HTML Help
• A patch to fix validation of certain incoming packets in the Windows implementation of the Server Messenger Block (SMB) protocol.

On unpatched systems, these critical vulnerabilities could allow an attacker to take full control of the vulnerable computer.

The patches labeled “important” fix several problems with Windows, including a cumulative patch for Outlook Express, a problem with Outlook Web Access and Exchange, and the Step-by-Step Interactive Training engine, which is used by some tutorials included with Windows and some Microsoft Press titles. Other publishers of training titles, including some OEMs, also distribute the Step-by-Step Interactive Training engine, so there is no definitive list of all the titles that may have been provided or preinstalled with this software. Therefore, Microsoft will offer this security update via Windows Update to Windows 2000, Windows XP, and Windows Server 2003 systems. However, Microsoft is not offering this patch for earlier versions of Windows, even though the affected software might be installed on those systems. (For a chart summarizing critical and important patches, see “June 2005 Security Communications Summary“.)