微軟2010年1月安全公告 Windows2000獨領風騷
原創【51CTO.com獨家特稿】之前總是大堆大堆的漏洞補丁和更新公告總是讓各運維人員提心吊膽的，北京時間1月13日上午，更新公告出來了。和51cto編輯之前文章所述一致，微軟果然就為Windows 2000發了一個補丁，XP/Vista/Windows 7用戶都不在嚴重威脅之列。而之前有消息說微軟不再給windows 2000發補丁的消息，看來也是謠傳了。
借用同行的一句話，請不是企業系統管理員的玩家無視掉本月的安全公告。
Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution (972270)
This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font in client applications that can render EOT fonts, such as Microsoft Internet Explorer, Microsoft Office PowerPoint, or Microsoft Office Word. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Embedded OpenType 字體引擎中的漏洞可能允許遠程執行代碼 (972270)
此安全更新解決了 Microsoft Windows 中一個秘密報告的漏洞。 如果用戶在可以呈現 EOT 字體的客戶端應用程序（如 Microsoft Internet Explorer、Microsoft Office PowerPoint 或 Microsoft Office Word）中查看以特制的 Embedded OpenType (EOT) 字體呈現的內容，則該漏洞可能允許遠程執行代碼。成功利用此漏洞的攻擊者可以完全控制受影響的系統。 攻擊者可隨后安裝程序；查看、更改或刪除數據；或者創建擁有完全用戶權限的新帳戶。那些帳戶被配置為擁有較少系統用戶權限的用戶比具有管理用戶權限的用戶受到的影響要小。
【編輯推薦】
