August 8, 2006 12:41 PM PDT
Another hefty patch month for Microsoft
Last modified: August 8, 2006 2:22 PM PDT
- Related Stories
-
Microsoft to plug PowerPoint hole
July 17, 2006 -
Microsoft plugs worm hole in Windows
July 11, 2006 -
Windows worm starts its spread
August 11, 2003
As part of its monthly security update cycle, Microsoft on Tuesday released a dozen security bulletins. Nine of them are tagged critical, the company's highest severity rating. The alerts give details of 20 flaws in Windows and three in Office, all of which Microsoft has now fixed.
Several of the issues, such as a vulnerability in PowerPoint, have already been publicly reported and are being actively used in cyberattacks. However, the bundle of updates also covers bugs that Microsoft discovered itself, the company said. These issues have not been publicly disclosed and are not described in the bulletins.
"Today, Microsoft patched 23 vulnerabilities, the highest number since their monthly patch program started," Monty Ijzerman, a senior manager at McAfee's Avert Labs, said in a statement. Of those flaws, 11 were publicly known or exploited before Microsoft provided fixes, he said.
Of specific interest is a remotely exploitable vulnerability in Windows, which Microsoft reports is already being used in attacks on PCs. The problem lies in a Windows service that provides support for networking features such as file sharing and printer sharing, the company said in security bulletin MS06-040.
"This is the one that we're encouraging people to prioritize and put on the top of the stack for their testing and deployment," Christopher Budd, security program manager at Microsoft, said in an interview. If immediate patching is not possible, Microsoft suggests using its workarounds, he said.
The flaw addressed in MS06-040 is the only one in Microsoft's Tuesday patch bunch that could let an anonymous attacker remotely commandeer a Windows PC without any user interaction, Budd said. Microsoft has seen a "very limited attack" that already exploited this flaw, he said.
The infamous MSBlast worm, which wreaked havoc in 2003, exploited a similar flaw, related to a Windows component called remote procedure call.
Last month, Microsoft patched a potential Windows worm hole when it released seven bulletins tackling 18 security flaws in Windows and Office. The patching rush started in June, when it released 12 bulletins. It came after a patch lull, with only three alerts in May, five in April and two in March.
Another of this month's flaws that could be exploited without any user interaction lies in the Windows Domain Name System (DNS) client, which is used to help translate URLs into numerical IP addresses. However, an attacker has to be on the same subnetwork as the intended target or must trick the user into making a DNS request to a malicious server, Microsoft said in bulletin MS06-041.
The bulk of the problems addressed by the August patches could be used for attacks via the Web or e-mail. They include security holes in the Internet Explorer Web browser, the Outlook Express e-mail client and other Windows and Office components.
For example, MS06-042 delivers fixes for eight IE bugs, and the user has to be duped into visiting a malicious Web site for attacks based on the holes to succeed, Microsoft said.
While it is a busy Patch Tuesday, Microsoft has not addressed all known flaws in its products. For example, a variant of a bug patched last month in a Windows component called "mailslot" is still without a fix. Proof-of-concept code that exploits this flaw was posted to the Net last month.
Microsoft recommends that people install the critical fixes immediately. The updates are available via the Windows Update and Automatic Updates tools. Temporary workarounds are outlined in the security bulletins for those who can't immediately apply the patches.
See more CNET content tagged:
bulletin,
DNS,
flaw,
fix,
vulnerability
Has anyone noticed their systems getting more unstable? Perhaps this is co-incidence with Vista coming out soon. I sure hope Apple rescues us from MS crap. Will Vista be considered spyware?
- August update disabled my keyboard
-
by Vetti
August 8, 2006 11:03 PM PDT
- After working on my computer for a few hours, I was prompted that I needed to restart my computer to finalize the security updates.
-
Reply to this comment
View
reply
-
-
See all 22 Comments >>However, as the computer was starting back up, I heard this fast beeping sound, then a black screen popped up that said something to the effect that the keyboard was not responding.
After the computer was completely up and running, I tried to use the keyboard, and sure enough, it didn't work. So I performed a system restore to earlier today, and everything worked perfectly. Obviously some problem with the security update.