Re: New M$ vulnerability patch for Windows -- MIDRANGE-L

> I have a theory that if you religously apply the updates and dont open
> attachments, then you cant be hacked and dont need a firewall. I hope
> someone else can prove if that is wrong or not.
That is wrong....email is only one of the methods of delivery, so not
opening
attachments shuts only one door. Yesterday's announcement by MS, indicated
they missed fixing the same general area (RPC) that Blaster got in, and
expected attacks to
start within hours. Not quite like Blaster, where MS claimed it's patch had
been
out for months.

btw- I was down a service pack for XP, so I updated yesterday, then went
back and
checked for updates, found fixes for the service pack and security fixes -
and updated, then went back and found several more security fixes. They seem
not to have mastered "supercede" like
our iSeries ptf's, so loading one set of fixes can trigger more required
fixes needed the very next time into Windows Update.

Also, when doing Windows Update, they have the "Critical Fixes", and the
there can be more
security fixes under your OS (Windows XP fixes for me), and more fixes under
Office Products, including many more security fixes.

Steve, of top of my head - outside of attachments:
any compromised website can do a scripting attack, plant trojans, etc. How
do you tell the diff between a marketing program and a trojan?
Port scanning will lead to direct attacks thru socket programs.
Word docs, Excel, etc from customers, co-workers may be infected and can
launch.
And it doesn't take an attachment for email to launch.
I'm on dsl, and use zone alarm pro. All day long it is blinking, blocking
the port scans.

jim

----- Original Message ----- 
From: "Steve Richter" <srichter@xxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Thursday, September 11, 2003 8:11 AM
Subject: RE: New M$ vulnerability patch for Windows


> I use windows automatic update, which for reasons I cant explain is not
> always automatic.  So every week I visit the windows update site and
> download all the w2k updates. So far I have not been burned by any faulty
> updates.
>
> I have a theory that if you religously apply the updates and dont open
> attachments, then you cant be hacked and dont need a firewall. I hope
> someone else can prove if that is wrong or not.
>
> -Steve
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of Carl Galgano
> Sent: Thursday, September 11, 2003 5:53 AM
> To: Midrange List
> Subject: New M$ vulnerability patch for Windows
>
>
> I know this is not directly related to the iSeries, but be aware that M$
has
> released yet another security patch for windows.  As far as I know, there
> are no viruses that exploit this vulnerability..... Yet.
> cjg
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>