Patch Tuesday no biggie, but beware of new IE issue

Stephen Withers
Wednesday, 10 March 2010 13:05

Business IT - Security

March 2010's Patch Tuesday was, as anticipated, a low-key affair with just two bulletins. But Microsoft has also warned of new and publicly disclosed vulnerability that is being exploited in older versions of its Internet Explorer browser.

Excel and Windows Movie Maker are the subject of March's security bulletins from Microsoft.

The Movie Maker issue affects versions 2.1 (from Windows XP), 2.6, and 6.0 (Vista). Opening a maliciously crafted project file could result in remote code execution and therefore a takeover of the system if the current user has admin rights.

The vulnerability was privately reported to Microsoft, and there is no indication that it is being exploited.

That said, Microsoft Producer 2003 is also vulnerable but has not been updated. Jerry Bryant, senior security communications manager lead at the Microsoft Security Response Center explained that Producer 2003 does not have an automatic update mechanism and the issue is still under investigation.

Consequently, Microsoft's advice is that Producer 2003 should be uninstalled, or at least dissociated from the project file type. An automated 'Fix it' for the latter approach can be found here.

Find out about the Excel vulnerability on page 2.