微軟2010年1月安全公告 Windows2000獨領(lǐng)風(fēng)騷
原創(chuàng)【51CTO.com獨家特稿】之前總是大堆大堆的漏洞補丁和更新公告總是讓各運維人員提心吊膽的，北京時間1月13日上午，更新公告出來了。和51cto編輯之前文章所述一致，微軟果然就為Windows 2000發(fā)了一個補丁，XP/Vista/Windows 7用戶都不在嚴(yán)重威脅之列。而之前有消息說微軟不再給windows 2000發(fā)補丁的消息，看來也是謠傳了。
借用同行的一句話，請不是企業(yè)系統(tǒng)管理員的玩家無視掉本月的安全公告。
Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution (972270)
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font in client applications that can render EOT fonts, such as Microsoft Internet Explorer, Microsoft Office PowerPoint, or Microsoft Office Word. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Embedded OpenType 字體引擎中的漏洞可能允許遠(yuǎn)程執(zhí)行代碼 (972270)
此安全更新解決了 Microsoft Windows 中一個秘密報告的漏洞。 如果用戶在可以呈現(xiàn) EOT 字體的客戶端應(yīng)用程序（如 Microsoft Internet Explorer、Microsoft Office PowerPoint 或 Microsoft Office Word）中查看以特制的 Embedded OpenType (EOT) 字體呈現(xiàn)的內(nèi)容，則該漏洞可能允許遠(yuǎn)程執(zhí)行代碼。成功利用此漏洞的攻擊者可以完全控制受影響的系統(tǒng)。 攻擊者可隨后安裝程序；查看、更改或刪除數(shù)據(jù)；或者創(chuàng)建擁有完全用戶權(quán)限的新帳戶。那些帳戶被配置為擁有較少系統(tǒng)用戶權(quán)限的用戶比具有管理用戶權(quán)限的用戶受到的影響要小。
【編輯推薦】
