http://www.informationweek.com/news/showArticle.jhtml?articleID=199400216 

By Sharon Gaudin
InformationWeek
May 8, 2007

In its monthly Patch Tuesday release, Microsoft today issued seven 
advisories -- all rated critical -- that patch 19 vulnerabilities that 
affect Windows, Office and Internet Explorer.

Three of the security bulletins handle bugs in Microsoft Office, with 
one each for Windows, Microsoft Exchange and Internet Explorer. One of 
the security bulletins also tackles a vulnerability in CAPICOM, which is 
an ActiveX control, and BizTalk, which is a central Microsoft platform 
for application integration.

Two of the vulnerabilities affect Microsoft's highly-touted Windows 
Vista operating system, while six of them are bugs in various versions 
of the company's ubiquitous browser, Internet Explorer. Five of the bugs 
are in IE7.

Seven different vulnerabilities, according to the advisory, could lead 
to code execution attacks against Word, Excel and Office.

"I think we are, in general, pleased because it does take care of a lot 
of issues, especially the DNS server vulnerability," said Amol Sarwatee, 
manager of vulnerability research labs at Qualys. "That was a zero-day 
that was out in the wild being exploited. We were really expecting a 
patch for it before today's patch Tuesday release."

The DNS issue was a zero-day vulnerability in several of Microsoft's 
server products could enable a hacker to divert the Web traffic of not 
just a single user but of a company's entire roster of employees.

Sarwatee called the DNS bug and the vulnerability in Exchange the most 
critical out of all the flaws being patched today.

Symantec also pointed out the Exchange bug as one of the more critical 
issues being fixed this month. The remote code execution vulnerability 
affects the MIME (Multipurpose Internet Mail Extensions) decoding 
mechanism of Microsoft Exchange Server, affecting versions 2000, 2003 
and 2007.

According to a security bulletin from Symantec, for the attack on 
Exchange to be successful, a user must open a malformed attachment. "A 
successful attack could completely compromise the computer hosting the 
vulnerable Exchange server and has the potential for impacting a large 
audience," reported Symantec researchers.


_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com