|
ALARM Group ALERT — click for a description of ALARM, The Computing Alert System Alert Number: 070204-01 Alert Date: 07/02/04 Alert Title: MS Patch released for IIS/IE Exploit Attack Update-to: 062504-01 OS/Platform/Application: Internet Explorer (all versions may be vulnerable) on Windows 2000, Windows Server 2003, Windows XP. Category: ALERT Severity: HIGH Attention: Windows System Administrators, Desktop Support Personnel |
Summary: Microsoft has released what it is calling a "configuration change" to address a vulnerability in its Internet Explorer browser that played a role in the spread of the IIS/IE exploit "Download.ject" attack. News of this attack prompted the sending of ALARM alerts 062504-1 and 062504-2 "IIS/IE Exploit Attack" and "ALERT Off-Campus IP address blocked (for IIS/IE Exploit Attack)".Recommended Actions: The configuration change is available on the http://windowsupdate.microsoft.com website. It is recommended that you read the information pertaining to this configuration change and if possible apply the patch immediately.
ITS Actions: At this time, ITS is taking no specific additional actions to counter this threat. An update will be issued if this situation changes.
Resources:
http://www.microsoft.com/security/incident/Download_Ject.mspx
http://www.microsoft.com/presspass/press/2004/jul04/07-02configchange.asp
http://www.microsoft.com/presspass/press/2004/jun04/0625download-jectstatement.aspNOTE: PLEASE DO NOT REPLY TO THIS ALERT. Alerts distributed by ALARM are not intended to supplant whatever security measures you are currently following. Technology coordinators, as well as the entire Ualbany computing community should continue to take all necessary precautions against threats to system security and information integrity.
Current Students | New Students | Distance Learners | Faculty | New Faculty | Staff
Training | Schedules / Hours | Forms | FAQs & User Guides | Policies | About ITS | Home
