Microsoft patches critical drive-by IE9 bug, Windows zero-day

Computerworld - Microsoft today patched 16 vulnerabilities, including one in Windows that's been exploited for weeks and two in Internet Explorer 9 (IE9) in the first-in-years back-to-back browser update.

Of Tuesday's nine security updates, three were rated "critical," Microsoft's most-severe threat ranking, while the others were pegged as "important," the next-most-serious label.

Among the products patched today were all versions of Windows; Office 2003, 2007 and 2010 on Windows; Office for Mac 2011; and IE9, Microsoft's newest browser that the company has touted as its most modern and most secure.

The three critical updates -- Microsoft dubs them bulletins -- were the ones tagged by Microsoft and independent security researchers as the first to apply.

As expected, Microsoft fixed a flaw in XML Core Services (MSXML) with MS12-043. The MSXML vulnerability has been actively exploited in targeted attacks against high-value victims, including those in aerospace and defense industries, for weeks. Microsoft acknowledged the attacks almost a month ago, but contrary to some experts' speculation, did not issue an emergency, or "out-of-band," update, instead waiting until the regular Patch Tuesday.

"Exploit code for this was published last week," said Jason Miller, manager of research and development at VMware, referring to attack code going public. "It's a zero-day, so it should be patched as soon as possible."

"It's being leveraged in the wild, so [MS12-043] has to be at the top of everyone's list," echoed Andrew Storms, director of security operations at nCircle Security.

Both Miller and Storms noted that Microsoft did not patch MSXML Core Services 5.0, a version bundled with Office 2003, Office 2007 and other Office-related products and components. "The security updates for Microsoft XML Core Services 5.0 are unavailable at this time," Microsoft said in the accompanying write-up.

"I'm guessing they ran out of time," said Miller of the omission of a patch for MSXML 5.0. "It's better to have something rather than have them wait [for the 3.0 fix] and give us nothing now."

Microsoft has said that all current attacks have exploited the vulnerability in MSXML Core Services 3.0, a version included with Windows.

"The exploit is already out there, so issuing [this partial patch] isn't going to create a detriment for anyone," said Storms. "The big question is 'When are we going to see the patch?'"

The company did not specify when the Core Services 5.0 fix would be released, or when it is finished, whether it would ship before next month's Patch Tuesday.

Both Windows 8 Consumer Preview and the newer Release Preview will also receive the MS12-043 update, Microsoft said.

Second on researchers' list was MS12-044, a two-patch update for IE9.