As security bulletins go, this March so far, Microsoft has only released a one security bulletin for Windows. But, a Security Release ISO Image was made available for download on March 9, 2010. The ISO image patch is made available to IT Admins who need to get the security patch without resorting to use the Windows Server Update Services (WSUS) or through some other automated solution that will present the patch for delivery and installation. This ISO release image contains multiple language versions of MS10-016. This is a security update that MicroSoft has offered to Windows users through Windows Update on March 9, 2010. It is designed to contain a hole in Windows Movie Maker program.

The vulnerability on Movie Maker could allow hackers to have remote code execution. An attacker could send to the user a Movie Maker or Microsoft Producer project file then convinced the hapless user to open the file.

Who can be affected by this security weakness? It turns out that users with administrative user rights could be more vulnerable than other users who with fewer user rights on the system. That is assuming that the administrator would invoke the program as a hacker would want.

How does this vulnerability affect Windows7?

In its default configuration, Windows7 is not affected. The operating systemdoes not have Windows Movie Maker as a base component. Furthermore, Microsoft has made it clear that the other video display program, Windows Live Movie Maker did not contain the vulnerability. This program is the Windows Live Essentials equivalent of the basic Movie Maker program.

How Does the Security Update Address the Vulnerability?
It does so by changing the way that Windows Movie Maker breaks up project files. But at the same time there is no security update available for Microsoft Producer 2003. But users can mitigate the impact to their systems from Microsoft Producer 2003 by using the automated solution which will remove the Microsoft Producer file associations. The solution is found using the Fix it in Microsoft Knowledge Base Article 975561.

Source: Microsoft

Microsoft Security Bulletin MS10-016

Download : Security Releases ISO Image March 2010