Fixing security vulnerabilities


Image representing Microsoft as depicted in Cr...
Image via CrunchBase

First it was Microsoft Patch Tuesday yesterday with Microsoft addressing a record 31 vulnerabilities.

Microsoft has released 10 security updates fixing a record number of Patch Tuesday holes, including one for a critical hole in Internet Explorer 8 that was exploited as part of a hacking contest at CanSecWest in March.

The bulletin addresses 31 vulnerabilities. “It’s the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003,” a Microsoft spokesman said.

The June security Patch Tuesday bulletin resolves eight vulnerabilities in IE, the more severe of which could allow remote code execution if a user views a specially crafted Web page. The IE8 vulnerability does not affect Windows 7 RC (build 7100), but does affect Windows 7 beta.

The updates also plug two critical holes in implementations of Active Directory on Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode installed on Windows XP Professional and Server 2003, the worse of which could allow an attacker to take control of a system remotely.

The security update fixes three critical vulnerabilities in Windows Print Spooler that could allow remote code execution if an affected server received a specially crafted RPC (remote procedure call) request.

Several vulnerabilities in Office Word and Excel are addressed in the update that could allow an attacker to remotely run code or take control of the machine using a specially crafted Word or Excel file. The update fixes the PowerPoint vulnerability Microsoft warned in April was being exploited in limited, targeted attacks that was fixed in the Windows version last month.

The update includes a patch for an important hole in its IIS Web server product that Microsoft reported in May.

“We didn’t see any in-the-wild exploitations of the (IIS WebDav) vulnerability but typically when Microsoft releases those alerts they’re doing it because a customer” has alerted them to an exploit,
said Steve Manzuik, senior manager of security research at Juniper Networks.

Also fixed is a critical vulnerability in Microsoft Works Converters, important vulnerabilities in RPC and Windows Kernel. And Microsoft fixed a moderate vulnerability in Windows Search that could allow
information disclosure if a user performs a search that returns a specially crafted file as the first result, or if the user previews a malicious file from the search results. By default, the Windows Search component is not preinstalled on Windows XP and Server 2003.

Products affected by the updates include Windows 2000, XP, XP Professional edition, Vista, Server 2003, Server 2008; Office 2000, 2003, 2007, and XP; and Microsoft Office 2004 and 2008 for the
Mac.

Other affected software includes Office Excel Viewer; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats; Works 8.5 and 9.0; and Office SharePoint Server. (Source: Microsoft issues patches – CNET News-Security)

Second up was Adobe with it’s first quarterly update.

Image representing Adobe Systems as depicted i...
Image via CrunchBase

In the first of its regular security updates, Adobe on Tuesday patched several “critical” vulnerabilities it has identified in Adobe Reader 9.1.1 and Acrobat 9.1.1, and earlier.

In a security advisory, Adobe said that the vulnerabilities would cause applications to crash and potentially enable an attacker to take control of an affected system. None of the flaws are being actively exploited, according to Adobe.

The advisory said that users of  Reader and Acrobat should update their products to versions 9.1.2, 8.1.6, or 7.1.3. The updates apply to Windows and Macintosh, but updates for Adobe Reader on UNIX platforms will have to wait until June 16.

Specifically, the updates address issues such as stack overflow, memory corruption and heap overflow vulnerabilities that could potentially lead to code execution. (Source: Adobe patches Reader and Acrobat for “critical vulnerabilities – SC Magazine US)

If you haven’t already done so it would be wise to apply the released patches.

Reblog this post [with Zemanta]
Advertisements

About brvanlanen

Just a thirty-something guy currently hanging it up in the greater Green Bay area. My post-high school educational background is mainly in the Information Technology field. Specifically I have an A.A.S. in Computer Network Systems and a B.S. in Information Systems Security, both from ITT Technical Institute, in addition to A and MCDST certifications. In my free time I enjoy spending time with my family, cooking and sports. My Christian faith is also important to me as a Missouri-Synod Lutheran and all my children attend a Lutheran grade school. When it comes to political leanings I am a conservative first and foremost which you will discover rather quickly. As for sports I am a huge fan of the Green Bay Packers.

Posted on June 10, 2009, in Adobe, Microsoft, Patch Tuesday, PC, Security, Server, vulnerability, Windows and tagged , , , , , , , . Bookmark the permalink. Comments Off on Fixing security vulnerabilities.

Comments are closed.

%d bloggers like this: