Microsoft Patches 19 Bugs With 7 Bulletins -- All Critical - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Software // Enterprise Applications

Microsoft Patches 19 Bugs With 7 Bulletins -- All Critical

The vulnerabilities being fixed include a highly critical bug in Microsoft Exchange and a zero-day flaw in the DNS Server Service.

In its monthly Patch Tuesday release, Microsoft today issued seven advisories -- all rated critical -- that patch 19 vulnerabilities that affect Windows, Office and Internet Explorer.

Three of the security bulletins handle bugs in Microsoft Office, with one each for Windows, Microsoft Exchange and Internet Explorer. One of the security bulletins also tackles a vulnerability in CAPICOM, which is an ActiveX control, and BizTalk, which is a central Microsoft platform for application integration.

Two of the vulnerabilities affect Microsoft's highly-touted Windows Vista operating system, while six of them are bugs in various versions of the company's ubiquitous browser, Internet Explorer. Five of the bugs are in IE7.

Seven different vulnerabilities, according to the advisory, could lead to code execution attacks against Word, Excel and Office.

"I think we are, in general, pleased because it does take care of a lot of issues, especially the DNS server vulnerability," said Amol Sarwatee, manager of vulnerability research labs at Qualys. "That was a zero-day that was out in the wild being exploited. We were really expecting a patch for it before today's patch Tuesday release."

The DNS issue was a zero-day vulnerability in several of Microsoft's server products could enable a hacker to divert the Web traffic of not just a single user but of a company's entire roster of employees.

Sarwatee called the DNS bug and the vulnerability in Exchange the most critical out of all the flaws being patched today.

Symantec also pointed out the Exchange bug as one of the more critical issues being fixed this month. The remote code execution vulnerability affects the MIME (Multipurpose Internet Mail Extensions) decoding mechanism of Microsoft Exchange Server, affecting versions 2000, 2003 and 2007.

According to a security bulletin from Symantec, for the attack on Exchange to be successful, a user must open a malformed attachment. "A successful attack could completely compromise the computer hosting the vulnerable Exchange server and has the potential for impacting a large audience," reported Symantec researchers.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
News
Python Beats R and SAS in Analytics Tool Survey
Jessica Davis, Senior Editor, Enterprise Apps,  9/3/2019
Slideshows
IT Careers: 10 Places to Look for Great Developers
Cynthia Harvey, Freelance Journalist, InformationWeek,  9/4/2019
Commentary
Cloud 2.0: A New Era for Public Cloud
Crystal Bedell, Technology Writer,  9/1/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Data Science and AI in the Fast Lane
This IT Trend Report will help you gain insight into how quickly and dramatically data science is influencing how enterprises are managed and where they will derive business success. Read the report today!
Slideshows
Flash Poll