Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Microsoft Security Advisory 975191 Revised

04 Sep 2009   #1
SGT Oddball

Microsoft Security Advisory 975191 Revised

Hi Everyone,

Today we updated Security Advisory 975191as we are now seeing limited attacks. Additionally, a new proof of concept published allowing for Denial of Service (DoS) attacks on Windows XP and Windows Server 2003 with read access to the File Transfer Protocol (FTP) service. This does not require Write access. Also, a new POC allowing DoS was disclosed this afternoon that affects the version of FTP 6 which shipped with Windows Vista and Windows Server 2008. Customers should be aware that the Download Center has FTP 7.5 available for Windows Vista and Windows Server 2008. FTP 7.5 is not vulnerable to any of these exploits.

The initial vulnerability was not responsibly disclosed to Microsoft, which has led to limited, active attacks putting customers at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.

Microsoft recommends customers review and implement the workarounds provided in the Advisory under the Workaround section. More information on suggested actions can be found in Microsoft Knowledge Base Article 975191.

While these workarounds do not completely mitigate the threat of DoS, we’re currently investigating the issue as part of our Software Security Incident Response Process (SSIRP) and working to develop a security update. This update will be released once it reaches an appropriate level of quality for broad distribution.

Additionally, we are actively working with partners in our Microsoft Active Protections Program (MAPP) as well as the Microsoft Security Response Alliance (MSRA) to share information that they can use to provide broader protections to customers.

For more technical details on the advisory, please see what our colleagues have written on Microsoft’s Internet Information Services (IIS) blog here: Microsoft IIS Blog. As always, be sure to check back here on the Microsoft Security Response Center (MSRC) blog or in the advisory for any additional information or updates that develop.

Thank you,

Alan Wallace

*This posting is provided "AS IS" with no warranties, and confers no rights*


My System SpecsSystem Spec

 Microsoft Security Advisory 975191 Revised

Thread Tools

Similar help and support threads
Thread Forum
Microsoft Security Advisory (2490606)
Microsoft Security Advisory (2490606): Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution Microsoft releases Security Advisory 2490606 - MSRC - Site Home - TechNet Blogs
Windows Updates & Activation
Microsoft Security Advisory (980088)
Microsoft Security Advisory (980088) Vulnerability in Internet Explorer Could Allow Information Disclosure Published: February 03, 2010 Version: 1.0 Microsoft is investigating a publicly reported vulnerability in Internet Explorer for customers running Windows XP or who have disabled Internet...
System Security
Microsoft Security Advisory 975191 Released
Microsoft Security Advisory 973882, Microsoft Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 21:28.
Twitter Facebook Google+