Sponsored By

Microsoft Patch Tuesday Brings Four FixesMicrosoft Patch Tuesday Brings Four Fixes

All of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

Thomas Claburn

September 9, 2008

2 Min Read

Microsoft on Tuesday released four Security Bulletins in conjunction with its regularly scheduled patch day.

All four of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible. MS08-052 addresses five privately reported vulnerabilities in the Microsoft Windows GDI+, a Windows graphics API. These flaws could allow the execution of malicious code if a user views a specially crafted image file. MS08-053 resolves a privately reported bug in Windows Media Encoder 9 that could allow an attacker to take control of an affected system if a user views a specially crafted Web page. MS08-054 fixes a privately reported vulnerability in Windows Media Player that could allow remote code execution when a malicious audio file is streamed from a Windows Media Server. MS08-055 repairs a privately reported vulnerability in Microsoft Office. The flaw could allow remote code execution if a user clicks on a maliciously crafted OneNote URL. "MS08-052 is the one that's going to hit everybody," said Eric Schultze, chief technology officer of Shavlik Technologies. Schultze said that GDI+ has been patched several times since 2004 and that MS08-052 is likely to be difficult for network administrators to deal with. It's easy to patch Microsoft Windows and Office, he said, but the flaw affects other software including SQL Server and Visual Studio. "You may not even know if you've patched everything because it affects so many programs," he said. Ben Greenbaum, senior research manager at Symantec Security Response, concurs. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail. To make matters worse, third-party vendors may include the vulnerable GDI+ component in their own software. This makes it necessary for administrators to find all instances of the affected GDI+ file on their systems, Schultze said. Microsoft plans to hold a Webcast to answer questions on these bulletins on September 10, 2008, at 11:00 AM PST. To help understand the security landscape better, InformationWeek has published its 2008 Security Survey entitled "We're Spending More, But Data's No Safer Than Last Year." Download the report here (registration required).

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.

You May Also Like

More Insights