Microsoft Patch Tuesday Brings Four Fixes

Microsoft on Tuesday released four Security Bulletins in conjunction with its regularly scheduled patch day.

All four of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

MS08-052 addresses five privately reported vulnerabilities in the Microsoft Windows GDI+, a Windows graphics API. These flaws could allow the execution of malicious code if a user views a specially crafted image file.

MS08-053 resolves a privately reported bug in Windows Media Encoder 9 that could allow an attacker to take control of an affected system if a user views a specially crafted Web page.

MS08-054 fixes a privately reported vulnerability in Windows Media Player that could allow remote code execution when a malicious audio file is streamed from a Windows Media Server.

MS08-055 repairs a privately reported vulnerability in Microsoft Office. The flaw could allow remote code execution if a user clicks on a maliciously crafted OneNote URL.

"MS08-052 is the one that's going to hit everybody," said Eric Schultze, chief technology officer of Shavlik Technologies.

Schultze said that GDI+ has been patched several times since 2004 and that MS08-052 is likely to be difficult for network administrators to deal with. It's easy to patch Microsoft Windows and Office, he said, but the flaw affects other software including SQL Server and Visual Studio. "You may not even know if you've patched everything because it affects so many programs," he said.

Ben Greenbaum, senior research manager at Symantec Security Response, concurs. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.

To make matters worse, third-party vendors may include the vulnerable GDI+ component in their own software. This makes it necessary for administrators to find all instances of the affected GDI+ file on their systems, Schultze said.

Microsoft plans to hold a Webcast to answer questions on these bulletins on September 10, 2008, at 11:00 AM PST.

To help understand the security landscape better, InformationWeek has published its 2008 Security Survey entitled "We're Spending More, But Data's No Safer Than Last Year." Download the report here (registration required).