Cumulative Patch for BizTalk Server New
Microsoft has released a cumulative patch for BizTalk Server 2000 and 2002 that addresses two newly reported vulnerabilities, the most serious of which could allow an attacker to run code of their choice on the system.

Flaw In ISA Server DNS Intrusion Detection Filter New
A security vulnerability exists in the DNS intrusion detecion filter of Microsoft Internet Security and Acceleration (ISA) Server 2000 which be used by a malicious user to cause a denial of service.

Flaw in Services for Unix 3.0 Interix SDK New
Windows Services for UNIX (SFU) 3.0 provides a full range of cross-platform services to integrate Windows into UNIX environments. SFU contains three vulnerabilities that could allow a malicious user to run the code of their choice or cause a denial-of-service.

Buffer Overrun in Terminal Services Web Control New
A buffer overrun vulnerability exists in the Terminal Services Advanced Client (TSAC) web control which could allow an attacker to run code in the security context of the currently logged on user.

Flaw in Metadirectory Services Could Allow Privilege Elevation New
A security flaw exists in Microsoft Metadirectory Services (MMS) which may allow a malicious user to access and manipulate data within MMS that should, by design, only be accessible to MMS administrators.

Unchecked Buffer in Commerce Server New
An unchecked buffer in profile service could allow a malicious user to run code of their choice, in the LocalSystem security context, on Microsoft Commerce Server 2000 or 2002.

Invalid RDP Data can Cause Terminal Service Failure New
A security vulnerability exists in the terminal service of Windows 2000 and Windows NT 4.0 which could allow a malicious user to cause a denial of service attack by sending malformed data packets.

ISA Server H.323 Gatekeeper Service Contains Memory Leak New
A security vulnerability exists in the Internet Security and Acceleration (ISA) Server Gatekeeper service and Winsock Proxy service which could allow a remote malicious user to cause a denial of service attack by exploiting a memory leak.

Services for Unix 2.0 Telnet and NFS Services Contain Memory Leaks New
A security vulnerability exists in the implementation of Telnet and NFS in Services for Unix (SFU) 2.0 which could allow a malicious user to cause a denial of service failure.

Web Request Can Cause Access Violation in ISA Server Web Proxy Service New
A security vulnerability exists in Microsoft ISA Server 2000 which could allow a remote attackers to cause a denial of service resulting in the failure of the Web Proxy service.

Directory Service Restore Mode Password Vulnerability
A security vulnerability exists which affects Microsoft® Windows® 2000 domain controllers. The vulnerability could allow a malicious user with physical access to a domain controller to install malicious software on it.

Netmon Protocol Parsing Vulnerability
A security vulnerability exists in Microsoft® Windows NT® and Windows® 2000 server products and Systems Management Server which could allow a malicious user to gain control of an affected server.

Remote Agent Permissions Vulnerability
A vulnerability exists in an installation routine associated with Microsoft® Systems Management Server (SMS). If particular features have been enabled, the vulnerability could allow a user to gain elevated privileges on the local machine.

Site Wizard Input Validation Vulnerability
On some of the sample sites and on custom-built sites created by the Site Builder Wizard, a Request.Querystring variable is directly appended to a SQL statement. Because this variable is not validated, it is possible for additional text to be appended. If this were done, the SQL commands would be executed as part of the query and could be used to create, modify, delete, or read data in the database.

Set Cookie Header Caching Vulnerability
A vulnerability exists in Microsoft® Site Server® and Microsoft Commercial Internet System® (MCIS) that could allow a web site visitor to inadvertently access another customer's data, if their Internet gateway caches web pages via a proxy server and the web site authenticates based on a GUID.

BackOffice Server 4.0 Does Not Delete Installation Setup File
A potential vulnerability exists in the installer for BackOffice Server 4.0. The installer asks the user to provide the account userid and password for selected services and writes these to a file in order to automate the installation process. However, the file is not deleted when the installation process completes.