Microsoft Patch Tuesday Brings Four Fixes - InformationWeek
IoT
IoT
Software // Operating Systems
News
9/9/2008
05:02 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Patch Tuesday Brings Four Fixes

All of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

Microsoft on Tuesday released four Security Bulletins in conjunction with its regularly scheduled patch day.

All four of the bulletins address vulnerabilities rated "critical," which means that remote execution of malicious code is possible.

MS08-052 addresses five privately reported vulnerabilities in the Microsoft Windows GDI+, a Windows graphics API. These flaws could allow the execution of malicious code if a user views a specially crafted image file.

MS08-053 resolves a privately reported bug in Windows Media Encoder 9 that could allow an attacker to take control of an affected system if a user views a specially crafted Web page.

MS08-054 fixes a privately reported vulnerability in Windows Media Player that could allow remote code execution when a malicious audio file is streamed from a Windows Media Server.

MS08-055 repairs a privately reported vulnerability in Microsoft Office. The flaw could allow remote code execution if a user clicks on a maliciously crafted OneNote URL.

"MS08-052 is the one that's going to hit everybody," said Eric Schultze, chief technology officer of Shavlik Technologies.

Schultze said that GDI+ has been patched several times since 2004 and that MS08-052 is likely to be difficult for network administrators to deal with. It's easy to patch Microsoft Windows and Office, he said, but the flaw affects other software including SQL Server and Visual Studio. "You may not even know if you've patched everything because it affects so many programs," he said.

Ben Greenbaum, senior research manager at Symantec Security Response, concurs. "The vulnerabilities that affect GDI+ are the most dangerous because GDI+ is used in such a large array of Microsoft and third-party software," he said in an e-mail.

To make matters worse, third-party vendors may include the vulnerable GDI+ component in their own software. This makes it necessary for administrators to find all instances of the affected GDI+ file on their systems, Schultze said.

Microsoft plans to hold a Webcast to answer questions on these bulletins on September 10, 2008, at 11:00 AM PST.

To help understand the security landscape better, InformationWeek has published its 2008 Security Survey entitled "We're Spending More, But Data's No Safer Than Last Year." Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Digital Transformation Myths & Truths
Transformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll