Microsoft Corp. has issued nine security updates addressing critical flaws in its Office and Windows products. The updates patch two worrisome PowerPoint flaws that could allow attackers to seize control of a PC, the company said Tuesday.
Of particular concern is a fix for Windows’ Server services, described in Microsoft Security Bulletin MS06-040. This update patches a vulnerability that has already been exploited by some attackers, according to Christopher Budd, a security program manager with Microsoft’s security response center. “The top thing that we’re trying to help people understand is we want them to take 06-040 and put it at the top of the stack,” he said.
Although the attack code for this flaw has not yet been publicly distributed, it has been used in “one or two” attacks, and it could possibly be exploited in a widespread way, Budd said. “It’s a network based vector and in this particular case, there’s no authentication required so anyone that can deliver a network packet to a vulnerable system… could potentially seek to exploit the vulnerability,” he said.
Security vendors agreed that the 06-040 flaw is a worry.
“The most important one is really the Server service vulnerability, given the fact that it is default-installed and default-running on all the major flavors of Windows,”said Gunter Ollmann, director of Internet Security Systems Inc.’s X-Force threat analysis service. “This is a prime vulnerability for exploitation and, in particular, for worms.”
This month’s security updates also include three patches for less-severe Windows problems, making a total of 12 software fixes for system administrators to contend with.
Office applications like PowerPoint have come under increasing scrutiny of late.
Last month, Microsoft patched 12 Office vulnerabilities in its security patch release. Days later Symantec Corp. discovered that hackers were trying to exploit a new one by sending e-mail with malicious PowerPoint attachments. This malware installed a Trojan horse program, called Trojan.PPDDropper.B, and a backdoor program called Backdoor.Bifrose.E on the PCs of any user who opened the document.
The critical patches issued Tuesday cover a wide range of issues, including problems in Internet Explorer and the Windows kernel, help system and Server service. Outlook Express, the Microsoft Management Console,Visual Basic, and the Windows DNS (Domain Name System) are also affected with critical flaws, Microsoft said.
In addition to the PowerPoint and Server services vulnerabilities, hackers have also been exploiting the Visual Basic flaw, described in bulletin MS06-047, Microsoft’s Budd said. However, all of these flaws have been attacked in a “very limited” way, he said.
The three less-serious patches fix problems in Windows Explorer, the Windows kernel and the Windows Hyperlink Object Library.
More information on the security updates can be found here: http://www.microsoft.com/technet/security/bulletin/ms06-aug.mspx
