Microsoft patches critical Windows drive-by bug
Also repairs 'DLL load hijacking' flaw in Vista, but leaves several vulnerabilities unfixed
Computerworld - Microsoft today patched three vulnerabilities in Windows, one that could be exploited by attackers who dupe users into visiting a malicious Web site.
The company also debuted a new defensive measure to help users ward off ongoing attacks that are exploiting a known bug in Internet Explorer (IE).
The light load -- just two security updates, or "bulletins" as Microsoft calls them -- was announced last week, making for an easier beginning to the new year than the end of 2010, when in December the company shipped a record 17 updates that patched a near-record 40 bugs.
One of today's updates was classified as "critical" by Microsoft, the firm's top threat ranking, while the other was marked as "important," the second-most dangerous rating.
MS11-002 was the update that security researchers and Microsoft recommended users apply first. The update patched two vulnerabilities, one critical, the other important.
"Attackers can exploit the critical vulnerability in MS11-002 by getting users to browse to a malicious Web site," said Amol Sarwate, manager of Qualys' vulnerabilities research labs. The tactic, usually called a "drive-by" attack, relies on enticing users to click a link that's offered in a baited e-mail.
"It's exploitable through a drive-by," confirmed Sarwate.
The bug is in the Microsoft Data Access Components (MDAC), a set of components that lets Windows access databases such as Microsoft's own SQL Server. The flaw is in the MDAC ActiveX control that allows users to access databases from within IE.
Only users running IE are at risk from attacks exploiting the critical bug Microsoft disclosed in MS11-002, said both Sarwate and Andrew Storms, the director of security operations at nCircle Security.
Microsoft also urged customers to apply MS11-002 first, noting that all client versions of Windows, including XP Service Pack 3 (SP3), Vista and Windows 7 were vulnerable. The server editions of the operating system are vulnerable as well, but for them Microsoft rated the threat as important, not critical.
Hackers will probably come up with reliable attack code to exploit the bugs patched by MS11-002 in the next 30 days.
The other update, dubbed MS11-001, is less important, said Sarwate and Storms, because it applies only to Windows Vista.
The Backup Manager bug is one of several so-called "DLL load hijacking" or "binary planting" vulnerabilities in Windows.
Today's fix for Vista was the seventh update Microsoft's released to repair flaws that researchers disclosed last August. Microsoft shipped five DLL load hijacking updates last month, and one in November.
In December, Microsoft said that the month's five updates were the last DLL load hijacking bugs it knew about. "This fixes all of the [Windows] components that we're aware of," said Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), in an interview Dec. 14. He left the door open to more, however. "We're not closing that [DLL load hijacking] advisory just yet, and will continue to investigate."
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts