[ insider_reports_insider ]
Microsoft Patches Code Execution Flaws
David Utter
Staff Writer
2007-05-09
 Insider Reports RSS Feed
Critical vulnerabilities posing remote code execution threats to several Microsoft products received fixes with the company's monthly patch updates.
 | | Microsoft Patches Code Execution Flaws |  |
Seven Critical bulletins from Microsoft addressed remote threat issues in Word, Excel, Exchange, and Internet Explorer. Five of the seven bulletins corrected multiple flaws within products.
A fix for the Windows DNS Server problem also arrived with the round of updates. An RPC management vulnerability could have allowed remote code execution. Reports of limited attacks against the flaw had been noted a month ago by security firm eEye.
Microsoft also corrected a Critical flaw with its CAPICOM (Cryptographic API Component Object Model). An ActiveX problem in CAPICOM also affected users of BizTalk Server 2004. Other versions of BizTalk were not affected.
Exchange updates that had been rumored last week proved to be real, with Microsoft fixing four vulnerabilities in the product. One of the four received the Critical rating; that problem stemmed from a MIME Decoding vulnerability.
McAfee Bitten By ActiveX: McAfee Security Center, a GUI controller for the company's products like antivirus and firewalls, required a fix for an ActiveX vulnerability. Firms that automatically update the Security Center should have the fix in place already.
Security firm iDefense Labs found a buffer overflow issue with an ActiveX control that comes with McAfee Security Center. An overflow could have led to the execution of arbitrary code.
An attacker would have needed to entice someone to visit a malicious website from a PC running the Security Center ActiveX control. An exploit would have run at the user's level of access; since Security Center is more of an administration tool, an attack could have taken in someone with elevated privileges.
---
Tags: Microsoft, Patch Tuesday, Computer, Security
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
