From: InfoSec News (alertsinfosecnews.org)
Date: Wed Jan 10 2007 - 00:11:44 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.eweek.com/article2/0,1895,2081067,00.asp

By Ryan Naraine
January 9, 2007

Microsoft has released high-priority fixes for serious vulnerabilities
in its Outlook and Excel applications, but there are no patches in the
January batch for known Microsoft Word flaws that are currently under
attack.

The Redmond, Wash., software maker released four bulletins with patches
for a total of 10 vulnerabilities, most rated "critical," but there is
no sign of fixes for the known code-execution Word bugs that have been
exploited in zero-day attacks since December 2006.

Microsoft originally planned to ship eight bulletins this month but four
were pulled at the eleventh hour, suggesting that there were problems
with the quality of the updates. One of the bulletins that was withdrawn
was slated to address Microsoft Office flaws, but it is not clear if
Word fixes were included.

The company's security response team has officially confirmed that at
least three undocumented Word vulnerabilities are being used in
code-execution attacks against select targets.

The first confirmed Windows Vista flaw, a denial-of-service issue that
was publicly released on an underground hacker site in Russia, also
remains unpatched.

Excel and Outlook patches

The bulk of the January patcheseight out of 10address holes in Excel and
Outlook, the spreadsheet and e-mail clients that ship as part of the
Microsoft Office suite.

There are five patches in MS07-002, all covering "remote code execution"
vulnerabilities in Excel. The flaws could be used by an attacker to take
"complete control" of a victim's computer, Microsoft warned.

Three separate patches have been released in MS07-003 to cover gaping
holes in Outlook. Two of the three flaws can cause remote code execution
attacks, Microsoft said.

A third "critical" bulletin, MS07-004, addresses a code execution issue
in the VML (Vector Markup Language) implementation in Microsoft Windows.

This is the second major VML flaw to haunt Windows users in recent
months. In September 2006, attackers targeted a Windows VML
implementation bug to plant rootkits and spyware programs on vulnerable
machines, forcing Microsoft to respond with an out-of-cycle Internet
Explorer patch.

Microsoft's January patch batch also includes MS07-001, which addresses
an "important" vulnerability in the Microsoft Office 2003 Brazilian
Portuguese Grammar Checker.

_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
 

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]