Microsoft patches 8 critical bugs in Windows, Office
Flaws in core graphics system, return of protocol handler bugs mark month's fixes
Computerworld - Microsoft Corp. today patched eight vulnerabilities, all rated critical, in four security updates for Windows, Office, Windows Media Player, Internet Explorer 6, SQL Server and other programs.
Unlike last month, when Microsoft issued 12 bulletins that fixed 26 flaws, today's patched vulnerabilities did not include any that have already been exploited in the wild.
"It doesn't look too bad today," said Andrew Storms, director of security operations at security vendor nCircle Network Security Inc., comparing the count to August's. "Although anything running Windows will have to be updated with MS08-052."
The update in that bulletin, highlighted by Storms and other experts as the one most crucial to apply immediately, fixes a total of five vulnerabilities in the GDI+ component of Windows. GDI+ (Graphics Device Interface) debuted in Windows XP and is a core part of Windows Vista and the current server-side operating systems, Windows Server 2003 and Windows Server 2008.
"It's one of the foundations for graphic display in Windows," said Storms. "Anyone running XP or newer -- and who isn't these days -- will have to update."
Hackers could exploit the GDI+ bugs by sending specially-crafted image files in a variety of formats -- including EMF, GIF, WMF and BMP -- to a user via e-mail, or by convincing users to visit sites that contain malicious image files. By triggering the vulnerabilities, attackers could then follow up with additional malware to hijack a system or steal data.
"This was the one we were most concerned about last week," said Storms, referring to last Thursday, when Microsoft, as is its practice, posted an advance notice of what it would deliver today. "Then, we predicted that it was going to be a core system or component. And that's essentially what we got."
Symantec Corp. researcher Ben Greenbaum echoed Storms' concern over MS08-052. "The vulnerabilities that affect GDI+ are the most dangerous, because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.
There's also the potential that attackers might be able to recycle older code to craft an attack. "At least one of these vulnerabilities is very similar to one that we have seen before," said Greenbaum. "So hackers may be able to use old code or at the very least apply knowledge gained from previous attacks as a starting point for creating new malicious code."
Although MS08-052 is the most important of the four, Storms didn't see it as any more difficult to handle than a run-of-the-mill update, at least for users and administrators. "But I think there was a high level of difficulty for Microsoft, and think they had to put a fair amount of research into this. They knew it was in the operating system, but they probably weren't sure how many other applications were affected."
To make his point, Storms noted the broad array of Microsoft software that is patched by the MS08-052 update, including Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, .Net Framework, Microsoft Office, Microsoft Visio, SQL Server and Visual Studio.
Of the remaining three updates, which patch one vulnerability each, Storms considered MS08-053 and MS08-054 as far less important. Those two updates address bugs in Windows Media Encoder (a free Microsoft tool for converting audio and video to the Windows Media formats, or capturing live content) and Windows Media Player 11, respectively.
"I don't find either of them highly important, because they're not going to be easy to exploit," Storms said.
MS08-055, which patches a protocol handler vulnerability in Microsoft Office -- specifically the OneNote protocol handler "onenote://" -- is another matter. "At least it's not a file format problem," said Storms, "but didn't Microsoft already learn about protocol handlers last year? They were a pretty big deal then, so why didn't they go back and look at [possible vulnerabilities] in other areas?"
Microsoft looks even more careless, Storms continued, because the vulnerability was spotted by an outside researcher, Brett Moore of Insomnia Security, rather than being reported internally.
Last year, Microsoft refused to fix Uniform Resource Identifier (URI) protocol handler vulnerabilities in Windows XP and Server 2003 for months, arguing that it was the fault of other software, not its own. In October, however, Microsoft owned up to the flaws -- which by then were being exploited by attackers -- and patched them the following month.
This month's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts