[ insider_reports_insider ]
Microsoft Patches Remote Execution Flaws
David Utter
Staff Writer
2006-07-12
 Insider Reports RSS Feed
All but one of the seven fixes in July's version of Microsoft's 'Patch Tuesday' updates closes a remote code execution vulnerability; the seventh fixes a hole that could allow access to information that in turn could be used to attack a system.
 | | Microsoft Patches Remote Execution Flaws |  |
We knew at least a couple of the seven patches to be released in July would address Critical issues in Office and Windows. By now, users with Automatic Update should have those new fixes on their machines, or be in the process of retrieving them.
Let's hope that's the case, because the propensity for virus and worm writers to quickly write exploit code for publicly known vulnerabilities has increased. Two of the vulnerabilities are probably more of a problem for enterprises than home users, as they affect the Server and DHCP Client services.
Two other ones also present more problems for businesses than for most individuals. Microsoft rated fixes for the .NET Framework and IIS as Important. The IIS issue can impact servers that have been configured to permit others to upload content to web sites. If exploited, arbitrary code could be executed on the system.
The remaining three patches address a series of vulnerabilities in the Office productivity suite. Excel by itself had eight issues addressed by one of the patches. Excel 2000 is the most threatened by the vulnerabilities, as Microsoft rated them Critical on that version of Excel, but only Important on 2002, 2003, and 2004 and v.x for Mac.
Flaws discovered in Excel and other Office applications can be particularly dangerous. While applications like IIS are usually watched over by IT personnel, just about anyone can be an Office user. In turn, just about any of those users can open a malicious document on the client side and let a worm spread across a network.
Utilities like Microsoft's Automatic Updates or a centralized patch management system have become increasingly important for enterprise businesses. Any IT manager who still has staffers running around the office to perform these updates PC by PC ought to rethink that strategy.
---
Tag: General
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
