[ news_security_news ]
Patch Tuesday At Last
John Stith
Staff Writer
2006-01-10
 Insider Reports RSS Feed
Redmond-based Microsoft released their long-awaited patch on Tuesday as part of their monthly security update. This month has been riddled with controversy as they did an early release for one problem last week and dropped two critical updates today.
The first problem, rated critical, involves a vulnerability in font processing. Like most of these updates, the problem could lead to remote code execution. Also remember the user has to be logged in as admin, which is a common security problem. The bulletin said this:
A remote code execution vulnerability exists in Windows because of the way that it handles malformed embedded Web fonts. An attacker could exploit the vulnerability by constructing a malicious embedded Web font that could potentially allow remote code execution if a user visited a malicious Web site or viewed a specially crafted e-mail message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
The other vulnerability is tied to Office and Exchange folks. The update fixes a problem in the Transport Neutral Encapsulation (TNEF). This one also has the problem of remote code activation and the admin issues. The bulletin had this to say:
A remote code execution vulnerability exists in Microsoft Outlook and Microsoft Exchange Server because of the way that it decodes the Transport Neutral Encapsulation Format (TNEF) MIME attachment.
An attacker could exploit the vulnerability by constructing a specially crafted TNEF message that could potentially allow remote code execution when a user opens or previews a malicious e-mail message or when the Microsoft Exchange Server Information Store processes the specially crafted message.
An attacker who successfully exploited this vulnerability could take complete control of an affected system
These updates will be crucial and can get in some damage. The problem though is one of these vulnerabilities took six months to correct. One can only hope they will move at a more rapid pace to correct other problems recently sighted in Windows.
About the Author:
John is a staff writer for SecurityProNews covering cyber security.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
