DHS is encouraging Windows operating systems users to avoid delay in applying this security patch. Attempts to exploit vulnerabilities in operating systems routinely occur within 24 hours of the release of a security patch. This vulnerability could impact government systems, private industry and critical infrastructure, as well as individual and home users.
Home users may prefer to go to Windows Update and select "express" to install critical security updates, including the MS06-040 security patch.
The Department's U.S. Computer Emergency Readiness Team (US-CERT) continues to work closely with Microsoft to minimize any impact from this vulnerability. US-CERT has issued an alert through the National Cyber Alert System and conducted a series of briefings with federal Chief Information Officers and Chief Information Security Officers, and critical infrastructure sectors through Information Sharing and Analysis Centers. Additionally, all federal agencies are required to provide US-CERT with regular updates on their patching status.
DHS recommends that computer users and administrators implement the following preparedness measures to protect themselves against this vulnerability, and also from future vulnerabilities, worms and viruses:
- Keep up-to-date on security patches and fixes for your operating system. The easiest way to do this is to set your system to receive automatic updates, which will ensure you automatically receive security updates issued by Microsoft. If your system does not allow automatic updates, DHS recommends that users manually install the Microsoft security patch through Microsoft Update.
- Install anti-virus and anti-spyware software and keep them up-to-date.
- Enable a firewall which will help block attacks before they can get into your computer.
- Do not open e-mails from unknown sources and do not open or execute e-mail attachments that you are not expecting even if they come from a known and trusted source.