Software // Operating Systems
05:02 PM
Connect Directly

Microsoft Patch Tuesday Brings Four Fixes

All of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

Microsoft on Tuesday released four Security Bulletins in conjunction with its regularly scheduled patch day.

All four of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

MS08-052 addresses five privately reported vulnerabilities in the Microsoft Windows GDI+, a Windows graphics API. These flaws could allow the execution of malicious code if a user views a specially crafted image file.

MS08-053 resolves a privately reported bug in Windows Media Encoder 9 that could allow an attacker to take control of an affected system if a user views a specially crafted Web page.

MS08-054 fixes a privately reported vulnerability in Windows Media Player that could allow remote code execution when a malicious audio file is streamed from a Windows Media Server.

MS08-055 repairs a privately reported vulnerability in Microsoft Office. The flaw could allow remote code execution if a user clicks on a maliciously crafted OneNote URL.

"MS08-052 is the one that's going to hit everybody," said Eric Schultze, chief technology officer of Shavlik Technologies.

Schultze said that GDI+ has been patched several times since 2004 and that MS08-052 is likely to be difficult for network administrators to deal with. It's easy to patch Microsoft Windows and Office, he said, but the flaw affects other software including SQL Server and Visual Studio. "You may not even know if you've patched everything because it affects so many programs," he said.

Ben Greenbaum, senior research manager at Symantec Security Response, concurs. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.

To make matters worse, third-party vendors may include the vulnerable GDI+ component in their own software. This makes it necessary for administrators to find all instances of the affected GDI+ file on their systems, Schultze said.

Microsoft plans to hold a Webcast to answer questions on these bulletins on September 10, 2008, at 11:00 AM PST.

To help understand the security landscape better, InformationWeek has published its 2008 Security Survey entitled "We're Spending More, But Data's No Safer Than Last Year." Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on for the week of October 9, 2016. We'll be talking with the editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll