Patch Tuesday rolls around: five critical updates

Stephen Withers
Wednesday, 09 September 2009 06:24

Business IT - Security

The latest security fixes from Microsoft all concern Windows, including the current flagships Vista and Server 2008. Some of the vulnerabilities allow 'drive-by' attacks and Microsoft is recommending prompt action.

As foreshadowed, Microsoft has released five security bulletins this month, all rated critical. All of the bulletins relate to Windows itself, and all allow remote code execution.

A JScript vulnerability affects Windows 2000, XP, Server 2003, Vista, and Server 2008 (including Server Core installations). An update for Windows 7 Release Candidate was also released, although Windows 7 RTM is not affected by any of this month's issues. Microsoft warns that it is likely that consistent exploit code will appear for the JScript issue.

An issue concerning the Wireless LAN AutoConfig service in Vista and Server 2008 (excluding Server Core installation) is difficult to exploit reliably, according to Microsoft officials. Nevertheless, it is rated critical on Vista and important on Server 2008.

A pair of vulnerabilities in Windows Media Format can be exploited though maliciously crafted media files. Consistent exploit code is expected for both issues, which are rated critical on all currently supported versions of Windows (including Server 2008 Server Core installations, but excluding Server 2008 for Itanium).

Multiple vulnerabilities in Windows' TCP/IP implementation are fixed this month. While remote code execution is possible, the flaws are difficult to exploit reliably and attacks are more likely to result in denial of service.

The affected versions are Windows 2000, Server 2003, Vista, and Server 2008. The severity is reduced to important on Windows 2000 and Server 2003.

The fifth bulletin concerns a vulnerability in the DHTML Editing Component ActiveX control, which can be exploited via a malicious web page. Inconsistent exploits are likely, according to Microsoft officials, and the issue is rated critical on Windows 2000 and XP, and moderate on Server 2003. Vista and Server 2008 are not affected.

Jerry Bryant of the Microsoft Security Response Center said "we are not addressing the IIS/FTP vulnerability announced in Security Advisory 975191 with this month’s security bulletin release. Our teams are still working on an update for this issue and we encourage customers to review the advisory for the most current guidance on this issue.

The recent bulletin covering vulnerabilities in the Active Template Library was re-released to provide additional protection for XP Media Center 2005 and Vista.

Microsoft also released the usual updates to the Malicious Software Removal Tool and the Windows Mail Junk E-Mail Filter.