Software // Operating Systems
05:02 PM
Connect Directly

Microsoft Patch Tuesday Brings Four Fixes

All of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

Microsoft on Tuesday released four Security Bulletins in conjunction with its regularly scheduled patch day.

All four of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

MS08-052 addresses five privately reported vulnerabilities in the Microsoft Windows GDI+, a Windows graphics API. These flaws could allow the execution of malicious code if a user views a specially crafted image file.

MS08-053 resolves a privately reported bug in Windows Media Encoder 9 that could allow an attacker to take control of an affected system if a user views a specially crafted Web page.

MS08-054 fixes a privately reported vulnerability in Windows Media Player that could allow remote code execution when a malicious audio file is streamed from a Windows Media Server.

MS08-055 repairs a privately reported vulnerability in Microsoft Office. The flaw could allow remote code execution if a user clicks on a maliciously crafted OneNote URL.

"MS08-052 is the one that's going to hit everybody," said Eric Schultze, chief technology officer of Shavlik Technologies.

Schultze said that GDI+ has been patched several times since 2004 and that MS08-052 is likely to be difficult for network administrators to deal with. It's easy to patch Microsoft Windows and Office, he said, but the flaw affects other software including SQL Server and Visual Studio. "You may not even know if you've patched everything because it affects so many programs," he said.

Ben Greenbaum, senior research manager at Symantec Security Response, concurs. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.

To make matters worse, third-party vendors may include the vulnerable GDI+ component in their own software. This makes it necessary for administrators to find all instances of the affected GDI+ file on their systems, Schultze said.

Microsoft plans to hold a Webcast to answer questions on these bulletins on September 10, 2008, at 11:00 AM PST.

To help understand the security landscape better, InformationWeek has published its 2008 Security Survey entitled "We're Spending More, But Data's No Safer Than Last Year." Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 Digital Issue, April 2015
The 27th annual ranking of the leading US users of business technology
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
. We've got a management crisis right now, and we've also got an engagement crisis. Could the two be linked? Tune in for the next installment of IT Life Radio, Wednesday May 20th at 3PM ET to find out.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.