Action Required

Article from www.News.com

Microsoft on Tuesday released a "critical" Internet Explorer update that fixes 10 vulnerabilities in the Web browser, including a high-profile bug that is already being used in cyberattacks.

The Redmond, Wash., software giant sent out the IE megafix as part of its monthly Patch Tuesday cycle of bulletins. In addition, Microsoft delivered two bulletins for "critical" Windows flaws, one for an "important" vulnerability in Outlook Express and one for a "moderate" bug in a component of FrontPage and SharePoint.

"This patch release is a big one with lots of aftershocks," said Jonathan Bitle, a product manager at security company Qualys. "Three of the five updates, the IE and Windows updates, are especially critical as they take advantage of inexperienced users...Although a worm epidemic is unlikely, users can be easily enticed to visit malicious Web pages."

Eight of the 10 vulnerabilities repaired by the IE update could be abused to gain complete control over a Windows computer running vulnerable versions of the Web browser. In all instances, an attacker would have to create a malicious Web site and trick people into visiting that site to hook into a PC, Microsoft said in its Security Bulletin MS06-013.

Microsoft rates its browser update "critical" for IE 5 and IE 6, the most-used versions of the popular software. IE is vulnerable on all current versions of the Windows operating system--Windows 2000, Windows XP and Windows Server 2003--as well as on the older Windows 98 and Windows Millennium Edition, the company said.

"An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system," Microsoft said in its alert. "We recommend that customers apply the update immediately." Windows users who have automatic updates enabled for the operating system will have the fixes delivered to them.

Read full article

Clients with WSUS Update Service:
1. Afinety will patch clients with WSUS Update Service by April 16, 2006.

2. The update is part of our normal update service. There is no charge for this update.

Clients without WSUS Update Service:
Clients that do not have WSUS Update Service should contact their Account Executive to schedule a consultation:

Account Exec	Area Code
Bryan Cox	213, 323, 805, 818
Mark Ledesma	310, 562, 626, 909, 951
Angie Moskalenko	619, 714, 760, 858, 949

Afinety will install and configure WSUS for your network and applications at a flat rate of $250.00 per network. Monthly update charges will be billed at $100 for the first server and $50 for each additional server. Windows Server Update Service (WSUS) is downloadable from the Microsoft web site at no cost.

Note: Afinety downloads and installs Microsoft Critical Updates only. All other updates are performed as necessary via Standard Afinety Support.