Microsoft released ten security updates, seven of which replace updates released in prior security bulletins. Microsoft rates six of these updates as critical, meaning that you should test and deploy them as soon as possible. Here's a brief description of each update; for more information, go to
http://www.microsoft.com/technet/security/bulletin/ms06-oct.mspx
MS06-056--Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure.
This vulnerability might allow an attacker to gain unauthorized access to information. It doesn't allow the execution of code to elevate user rights, but could be used to acquire information helpful for an attacker wishing to compromise the affected system.
Applies to: Windows 2000 SP4, Windows XP SP1 and SP2, XP Professional x64, XP Tablet PC and Media Edition, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64.
Recommendation: Test and deploy as part of the normal patch management cycle.
MS06-057--Vulnerability in Windows Shell Could Allow Remote Code Execution
This update relates to a publicly reported vulnerability that lets an attacker gain the same rights as the logged-on user. This update replaces one released with Security Bulletin MS06-045--Vulnerability in Windows Explorer Could Allow Remote Code Execution.
Applies to: Windows 2000 SP4, Windows XP SP1 and SP2, XP Professional x64, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64.
Recommendation: Test and deploy as soon as possible.
MS06-058--Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution.
This vulnerability could allow an attacker to gain the rights of the locally logged on user if that user opens a specially configured PowerPoint presentation. This update replaces one released with Security Bulletin MS06-028.
Applies to: Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, and Office 2004 and v.X for Mac.
Recommendation: If your organization uses PowerPoint, test and deploy as soon as possible. Remind users not to open untrusted PowerPoint presentations.
MS06-059--Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution
This vulnerability could allow an attacker to gain the rights of the locally logged on user if that user opens a specially configured Excel document. This update replaces one released with Security Bulletin MS06-037.
Applies to: Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 and v.X for Mac, and Microsoft Works Suite 2004, 2005, and 2006.
Recommendation: If your organization uses Excel, test and deploy as soon as possible. Remind users not to open untrusted Excel documents.
MS06-060--Vulnerabilities in Microsoft Word Could Allow Remote Code Execution
This vulnerability could allow an attacker to gain the rights of the locally logged on user if that user opens a specially configured Word document. This update replaces one released with Security Bulletin MS06-027.
Applies to: Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 and v.X for Mac, and Microsoft Works Suite 2004, 2005, and 2006.
Recommendation: If your organization uses Word, test and deploy as soon as possible. Remind users not to open untrusted Word documents.
MS06-061--Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution.
This vulnerability allows an attacker to assume the rights of the locally logged on user. This update replaces one released with Security Bulletin MS02-008--XMLHTTP Control Can Allow Access to Local Files.
Applies to: Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Windows 2000 SP4, Windows XP SP1 and SP2, XP Professional x64, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64. Also applies to Microsoft Office 2003 SP1 and SP2 with Microsoft XML Core Services 5.0 SP1.
Recommendation: Test and deploy immediately.
MS06-062--Vulnerabilities in Microsoft Office Could Allow Remote Code Execution
An attacker who exploits this publicly disclosed vulnerability will be able to take on all the rights of the locally logged on user. This update replaces one released with Security Bulletin MS06-048.
Applies to: Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 and v.X for Mac, Microsoft Project 2000 SR1, Project 2002 SP1, and Microsoft Visio 2002 SP2.
Recommendation: If your organization uses any of the affected software, test and deploy immediately.
MS06-063--Vulnerability in Server Service Could Allow Denial of Service
This vulnerability relates to the server service. An attack using this vulnerability could cause the affected system to stop functioning. The update in this bulletin replaces one released with Security Bulletin MS06-035--Vulnerability in Server Service Could Allow Remote Code Execution.
Applies to: Windows 2000 SP4, Windows XP SP1 and SP2, XP Professional x64, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64.
Recommendation: Test and deploy as a part of your regular patch management cycle.
MS06-064--Vulnerability in TCP/IP IPv6 Could Allow Denial of Service.
This update relates to a Denial of Service (DoS) vulnerability in IPv6, which few organizations have deployed at this stage.
Applies to: Windows XP SP1 and SP2, XP Professional x64, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64.
Recommendation: Organizations that don't use IPv6 don't need to apply this update to their computers.
MS06-065--Vulnerability in Windows Object Packager Could Allow Remote Execution
An attacker who exploits this vulnerability could take complete control of the affected system. To do this, the locally logged on user would need to open a specially constructed file that would enable the execution of remote code if the user visited a specially configured Web page. Significant user interaction is required to exploit this vulnerability.
Applies to: Windows XP SP1 and SP2, XP Professional x64, Windows Server 2003 and SP1, Windows 2003 Itanium and SP1, and Windows 2003 x64.
Recommendation: Remind users to be careful about opening untrusted files. Test and deploy as a part of your organization's regular patch management cycle.
