[ insider_reports_insider ]
Microsoft Fixes Long-Standing MDB Flaw
David Utter
Staff Writer
2008-05-14
 Insider Reports RSS Feed
Remote code execution vulnerabilities received attention from Microsoft in its most recent edition of Patch Tuesday updates; one has been publicly known for seven months.
 | | Microsoft Fixes Long-Standing MDB Flaw |  |
No real surprises emerged when Microsoft disclosed what it had hinted at previously. Flaws in the programs Word and Publisher, and in the Jet Database Engine, posed remotely exploitable threats.
The update to the word processing component of Microsoft Office corrected several problems. Word contained several issues reported privately to the company by third-party security researchers.
With the Word and Publisher flaws, someone would have to open a specially crafted file to trigger an exploit. That posed an ongoing risk for people who could have received such an exploit through a botnet-driven spam campaign, should someone have chosen to attack that way.
The Jet Engine issue posed a similar security concern, but on a different scale. Details of its problem, an MDB file parsing stack overflow vulnerability, first became known in security circles around November 2007.
That Jet flaw received notice in a posting to the Full Disclosure mailing list on November 16th last year.
"Microsoft replied me that they would not fix this vulnerability; it looks like they will not acknowledge vulnerabilities which are from (an) .mdb file," the poster said, citing this reply from Microsoft:
"You appear to be reporting an issue with a file type Microsoft considers to be unsafe. Many programs, such as Internet Explorer and Outlook, automatically block these files. For more information, please visit http://support.microsoft.com/kb/925330"
Fortunately, Microsoft finally deemed the issue worthy of further attention, resulting in the patch issued on May 13th.
View All Articles by David Utter
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
