Another month, another 5 critical flaws for Microsoft

Stan Beer
Wednesday, 12 July 2006 05:53

Business IT - Security

Microsoft users are getting used to it. However, it becomes no less disconcerting to be told that this month that yet another five critical flaws have been found that if exploited could hand over control of their computers to hackers.

The five flaws include two that affect Windows and three that affect Microsoft Office. In Microsoft's words, the flaws are so serious that they could "allow remote code execution". Products affected by the Office vulnerabilities include the entire range, plus some that affect just Excel, Project, Visio, Works and Visual Studio.

Aside from the critical flaws, a further two flaws rated as "important" have been found. This is the next highest security level. One affects the development platform ASP.Net which could allow an attacker to bypass ASP.Net security and gain unauthorized access to objects in the Application folder explicitly by name. The other involves a vulnerability in Microsoft Internet Information Services using Active Server Pages. While it has not been classed as critical, this vulnerability could allow an attacker to take complete control of an affected systems.

While Microsoft has promised that security for Windows Vista will be greatly improved, it is becoming clear that software company is fighting an increasingly steeper uphill battle against malware writers, with each month unveiling a swag of new critical flaws.

It is an unfortunate fact of life that Windows users can no longer safely go online unless they're system is innoculated to the hilt with anti-virus, anti-spyware, anti-spam products and a firewall system. It would seem reasonable to most users paying a hefty license fee to use Windows that this protection should be afforded as standard. Instead, however, Microsoft has launched a revenues earning security suite in competition with other security vendors.