Virus or from Microsoft?

From: Peter Quirk (Peter_Quirk_nospam_at_hotmail.com)
Date: 08/05/03


Date: Mon, 4 Aug 2003 19:43:16 -0700


It looks very spurious to me. Here's the HTML source:

<HTML>
<BODY>

*** PLEASE NOTE: Due to the critical importance of this
message, <BR>
this communication is being sent to all of our Microsoft
customers <BR>
to alert you of this Security Bulletin. *** <BR>
 <BR>
It has been widely reported in the press and on
Microsoft's own web <BR>
site, that on July 16th we released a critical security
bulletin <BR>
(MS03-026) and a patch regarding a vulnerability in the
Windows <BR>
operating system. We wanted to make sure that if you were
not aware <BR>
of this bulletin and corresponding patch that you take a
moment to <BR>
go to <A HREF="http://email.microsoft.com/m/s.asp?
HB9708454458X2612303X228387X">http://www.microsoft.com/secu
rity/ security_bulletins/ <BR>
ms03-026.asp</A> to find out if you are running an
affected version of <BR>
the Windows operating system and get the specific
information as to <BR>
what you need to do to apply this patch if you have not
already. <BR>
 <BR>
Although we encourage you to pay attention to all security
bulletins <BR>
and to deploy patches in a timely manner we wanted to call
special <BR>
attention to this particular instance as we have become
aware of <BR>
some activity on the internet that we believe increases
the <BR>
likelihood of the exploitation of this vulnerability.
Specifically, <BR>
code has been published on several web sites that would
allow <BR>
someone to spread a worm/virus that takes advantage of the
<BR>
vulnerability in question thereby impacting your <BR>
computing environment. <BR>
 <BR>
Although it is our goal to produce the most secure and
dependable <BR>
products possible, we do become aware of these types of
<BR>
vulnerabilities. In order to minimize the risks of such
<BR>
vulnerabilities to your computing environment, we
encourage you to <BR>
subscribe to the Windows Update service by going to <BR>
<A HREF="http://email.microsoft.com/m/s.asp?
HB9708454458X2612304X228387X">http://www.windowsupdate.com<
/A> and also subscribe to Microsoft's <BR>
security notification service at <A
HREF="http://email.microsoft.com/m/s.asp?
HB9708454458X2612305X228387X">http://register.microsoft.com
/ <BR>
subscription/subscribeme.asp?ID=135</A> if you have not
already. By <BR>
subscribing to these two services you will automatically
receive <BR>
information on the latest software updates and the latest
security <BR>
notifications thereby improving the likelihood that your
computing <BR>
environment will be safe from worms and viruses that
occur. <BR>
 <BR>
We apologize for any inconvenience the implementation of
this patch <BR>
might cause and appreciate you taking the time to update
<BR>
your system. <BR>
 <BR>
Thank you, <BR>
Microsoft Corporation <BR>
<BR>
<BR>
<BR>
<BR>
<font size="1"></font> <BR>
<img width="1" height="1"
src="http://www.m0.net/m/logopen02.asp?
vid=1102&catid=9708454458&ecid=0" alt=" ">
</BODY>
</HTML>

>-----Original Message-----
>
>I received the following e-mail. Is this a true e-mail
>from Microsoft or is this a virus waiting to happen?
>
>
>
>
>*** PLEASE NOTE: Due to the critical importance of this
>message,
>this communication is being sent to all of our Microsoft
>customers
>to alert you of this Security Bulletin. ***
>
>It has been widely reported in the press and on
>Microsoft's own web
>site, that on July 16th we released a critical security
>bulletin
>(MS03-026) and a patch regarding a vulnerability in the
>Windows
>operating system. We wanted to make sure that if you were
>not aware
>of this bulletin and corresponding patch that you take a
>moment to
>go to http://www.microsoft.com/security/
>security_bulletins/
>ms03-026.asp to find out if you are running an affected
>version of
>the Windows operating system and get the specific
>information as to
>what you need to do to apply this patch if you have not
>already.
>
>Although we encourage you to pay attention to all
>security bulletins
>and to deploy patches in a timely manner we wanted to
>call special
>attention to this particular instance as we have become
>aware of
>some activity on the internet that we believe increases
>the
>likelihood of the exploitation of this vulnerability.
>Specifically,
>code has been published on several web sites that would
>allow
>someone to spread a worm/virus that takes advantage of
>the
>vulnerability in question thereby impacting your
>computing environment.
>
>Although it is our goal to produce the most secure and
>dependable
>products possible, we do become aware of these types of
>vulnerabilities. In order to minimize the risks of such
>vulnerabilities to your computing environment, we
>encourage you to
>subscribe to the Windows Update service by going to
>http://www.windowsupdate.com and also subscribe to
>Microsoft's
>security notification service at
>http://register.microsoft.com/
>subscription/subscribeme.asp?ID=135 if you have not
>already. By
>subscribing to these two services you will automatically
>receive
>information on the latest software updates and the latest
>security
>notifications thereby improving the likelihood that your
>computing
>environment will be safe from worms and viruses that
>occur.
>
>We apologize for any inconvenience the implementation of
>this patch
>might cause and appreciate you taking the time to update
>your system.
>
>Thank you,
>Microsoft Corporation
>
>
>
>
>
>
>.
>



Relevant Pages

  • SecurityFocus Microsoft Newsletter #176
    ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows XP HCP URI Handler Arbitrary Command Execu... ... PHPNuke Category Parameter SQL Injection Vulnerability ... Microsoft Baseline Security Analyzer Vulnerability Identific... ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #242
    ... MICROSOFT VULNERABILITY SUMMARY ... PostNuke Blocks Module Directory Traversal Vulnerability ... Groove Networks Groove Virtual Office COM Object Security By... ... The Microsoft Windows IPV6 TCP/IP stack is prone to a "loopback" condition initiated by sending a TCP packet with the "SYN" flag set and the source address and port spoofed to equal the destination source and port. ...
    (Focus-Microsoft)
  • [NT] Cumulative Security Update for Internet Explorer (MS04-025)
    ... Get your security news from a reliable source. ... * Microsoft Windows NT Workstation 4.0 Service Pack 6a ... Navigation Method Cross-Domain Vulnerability ...
    (Securiteam)
  • SecurityFocus Microsoft Newsletter # 87
    ... Meeting IT Security Benchmarks Through IT Audits ... MICROSOFT VULNERABILITY SUMMARY ... Bypassing Windows 2000 Domain Password settings ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #75
    ... Microsoft's Internet Security & Acceleration Server with fault-tolerance ... The Microsoft UPnP Vulnerability ... Relevant URL: ...
    (Focus-Microsoft)