Menu
Eight flaws in Windows, Office patched

Eight flaws in Windows, Office patched

On Patch Tuesday Microsoft fixed eight vulnerabilities, all rated critical, in four security updates for Windows, Office, Windows Media Player, Internet Explorer 6, SQL Server and other programs.

Unlike last month, when Microsoft issued 12 bulletins that fixed 26 flaws, today's patched vulnerabilities did not include any that have already been exploited in the wild.

"It doesn't look too bad today," said Andrew Storms, director of security operations at security vendor nCircle Network Security Inc., comparing the count to August's. "Although anything running Windows will have to be updated with MS08-052."

That bulletin, highlighted by Storms and other experts as the one most crucial to patch immediately, fixes a total of five vulnerabilities in the GDI+ component of Windows. GDI+ (Graphics Device Interface) debuted in Windows XP, and is a core part of Windows Vista and the current server-side operating systems, Windows Server 2003 and Windows Server 2008.

"It's one of the foundations for graphic display in Windows," said Storms. "Anyone running XP or newer -- and who isn't these days -- will have to update."

Hackers could exploit the GDI+ bugs by sending specially-crafted image files in a variety of formats -- including EMF, GIF, WMF and BMG -- to a user via e-mail, or by convincing users to visit sites that contain malicious images files. By triggering the vulnerabilities, attackers could then follow up with additional malware to hijack the system or steal data.

"This was the one we were most concerned about last week," said Storms, referring to last Thursday, when Microsoft, as is its practice, posted an advance notice of what it would deliver today. "Then, we predicted that it was going to be a core system or component. And that's essentially what we got."

Symantec Corp. researcher Ben Greenbaum echoed Storms' concern over MS08-052. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.

There's also the potential that attackers might be able to recycle older code to craft an attack. "At least one of these vulnerabilities is very similar to one that we have seen before," said Greenbaum, "so hackers may be able to use old code or at the very least apply knowledge gained from previous attacks as a starting point for creating new malicious code."

Although MS08-052 is the most important of the four, Storms didn't see it as any more difficult to handle than a run-of-the-mill update, at least for users and administrators. "But I think there was a high level of difficulty for Microsoft, and think they had to put a fair amount of research into this. They knew it was in the operating system, but they probably weren't sure how many other applications were affected."

To make his point, Storms noted the broad array of Microsoft software that is patched by the MS08-052 update, including Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, .Net Framework, Microsoft Office, Microsoft Visio, SQL Server and Visual Studio.

Of the remaining three updates, which patch one vulnerability each, Storms considered MS08-053 and MS08-054 as far less important. The two updates address bugs in Windows Media Encoder, a free Microsoft tool for converting audio and video to the Windows Media formats, or capturing live content; and in Windows Media Player 11, respectively.

"I don't find either of them highly important, because they're not going to be easy to exploit," Storms said.

MS08-055, which patches a protocol handler vulnerability in Microsoft Office -- specifically the OneNote protocol handler "onenote://" -- is another matter. "At least it's not a file format problem," said Storms, "but didn't Microsoft already learn about protocol handlers last year? They were a pretty big deal then, so why didn't they go back and look at [possible vulnerabilities] in other areas?"

Microsoft looks even more careless, Storms continued, because the vulnerability was spotted by an outside researchers, Brett Moore of Insomnia Security, rather than being reported internally.

September's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags WindowsofficeWindows media playersql serverInternet Explorer 6international news

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments