Microsoft's holiday bonus: Fixes for 40 flaws

Computerworld - Microsoft today patched 40 vulnerabilities in Windows, Internet Explorer (IE), Office, SharePoint and Exchange, including nine pegged "critical."

Five of the 17 security updates -- Microsoft calls them "bulletins" -- fixed long-standing flaws that could be used by attackers to plant malware on a PC by tricking Windows into thinking a malicious DLL (dynamic link library) was actually a legitimate part of the OS.

Only two of the 17 updates were judged critical, Microsoft's top-most threat ranking in its four-step scoring system. Another 14 were marked "important," the second-highest rating, while the remaining update was labeled "moderate."

Microsoft put the spotlight on the two critical bulletins, as did several security experts.

"Both MS10-090 and MS10-091 are pretty critical, I think," said Andrew Storms, director of security operations for nCircle Security. "Microsoft's evaluation seems in line with what I would expect, and shows that they're giving a pretty fair and balanced representation of priorities."

Amol Sarwate, manager of Qualys' vulnerabilities research labs, agreed with Storms, putting those updates at the top of his list, too.

MS10-090 patches seven vulnerabilities in IE, six of them critical and one marked moderate. All supported versions, including 2009's IE8, are affected by one or more of the bugs. IE9, which is still in beta testing, does not harbor any of the seven vulnerabilities, Microsoft said in its advisory.

Among the patched IE bugs were three that had been publicly disclosed before today, and one that hackers have been exploiting for at least the last six weeks.

Microsoft confirmed the latter on Nov. 3 in a security advisory, but was unable to craft and test a patch in time to make it into that month's security update.

MS10-091, which in Microsoft's eyes is a Windows update, also affected browsers -- but not IE directly.

Instead, attackers could exploit the three vulnerabilities in the update -- all rated critical -- through non-Microsoft browsers that support the open-source OpenType font format by simply tricking users into visiting a malicious site.

Microsoft did not list the affected browsers, but the other four of the top five -- Firefox, Chrome, Safari and Opera -- all support OpenType fonts.

It's unclear today whether those browsers need to be patched separately, and if so whether they have been patched. For its part, Microsoft said it had reached out to the other browser makers to let them know about the OpenType bugs it was addressing.

Opera Software, whose security team co-reported one of the three OpenType vulnerabilities to Microsoft, said that other browsers did not need repair.

"The patch for Opera is the referenced Microsoft [MS10-091] patch, as it is not possible for the [browser] to protect itself against the problem, except by disabling webfonts, since the problem is in the OS's handling of fonts," said Thomas Ford, an Opera spokesman.