St. Bernard Software Technical Advisory: Critical Microsoft Windows Flaws Present Similar Vulnerabilities Exploited by Blaster Worm.

Business Editors/High-Tech Writers

SAN DIEGO--(BUSINESS WIRE)--Sept. 11, 2003

St. Bernard Software Inc. advises users of its UpdateEXPERT(R) patch management and remediation solution to verify that they have installed the latest Microsoft(R) cumulative security patch, MS03-039, to protect their systems from severe vulnerabilities that could open networks up to attack. Designated as "critical," Microsoft's highest severity rating, MS03-039 addresses three flaws in several versions of Windows(R) that leave a user open to a wide variety of threats, such as variants of the Blaster worm that spread across the Internet in August 2003. St. Bernard added the patch to its English and German UpdateEXPERT databases on the same day it was released by Microsoft -- Sept. 10, 2003.

The MS03-039 patch essentially supersedes a previous Microsoft patch, MS03-026, which garnered worldwide attention after the Blaster worm exploited a flaw in the remote procedure call (RPC) process, even though the patch had been issued weeks earlier. As with MS03-026, Microsoft advises that all users of Windows NT 4.0, Windows 2000, Windows Server 2003 and Windows XP apply the MS03-039 patch immediately. St. Bernard also recommends rebooting target workstations and servers immediately to ensure the patch is installed and valid.

According to Microsoft, the RPC flaw that MS03-039 fixes produces a similar vulnerability as MS03-026 in terms of potential damage, but it affects the RPC function differently. The patch also repairs two buffer overruns in the Distributed Component Object Model (DCOM) interface, which could allow a hacker to take over management rights to a computer by allowing arbitrary code to execute. By exploiting these flaws at the same time, unwanted programs can be loaded onto a computer via the buffer overrun flaws, which could then launch a denial-of-service attack across the Internet similar to the Blaster worm's intended attack on Microsoft's update Web sites.

With the ongoing rash of malicious viruses and worms that have propagated around the Internet in 2003, including the most recent Blaster worm and SoBig.F virus, St. Bernard Software reinforces its recommendation that organizations keep up to date with all Microsoft patches. The use of intelligent third-party software solutions like St. Bernard's UpdateEXPERT can perform this critical function easily and cost-effectively without draining IT staff resources.

More information on UpdateEXPERT can be found at www.updateexpert.com.

About St. Bernard Software Inc.

St. Bernard Software Inc. is a global provider of security solutions that protect against data loss, system threats, Internet abuse and unsolicited e-mail. Through its products and services, St. Bernard Software helps companies protect their bottom line by securing networks against major risks before they happen. The company's products include Open File Manager(TM), which captures open and in-use files during the backup process; UpdateEXPERT(R), which solves system and application security problems by keeping software patch levels current; iPrism(R), an Internet access management appliance that monitors, filters and reports on inappropriate Internet usage; and ePrism, a dedicated e-mail filtering and spam management appliance for enterprises of all levels.

Founded in 1995, with corporate headquarters in San Diego and an international office in London, St. Bernard Software sells and supports its award-winning products through key solution partners worldwide. St. Bernard Web site: http://www.stbernard.com/.

(C) 2003 St. Bernard Software. All rights reserved. St. Bernard Software, the St. Bernard Software logo, Open File Manager and UpdateEXPERT are trademarks or registered trademarks of St. Bernard Software Inc. iPrism is a registered trademark of Internet Products Inc. Internet Products is a wholly owned subsidiary of St. Bernard Software Inc. All other trademarks and registered trademarks are hereby acknowledged.