Thursday, June 30, 2022

Microsoft security fixes focus on Windows desktop

Microsoft has released four sets of security updates for its products, fixing critical flaws in the Windows desktop.

The software maker’s monthly set of security updates, released Tuesday, mostly fixes problems in the underlying operating system, but also includes a patch for a component of the OneNote note-taking software that is used by Microsoft Office.

In all, eight bugs are squashed in the four sets of patches, but the most critical problem is addressed in the MS08-052 update, according to Andrew Storms, director of security operations with security vendor nCircle. This update fixes five bugs in the Graphics Device Interface+ (GDI+) software used by Windows programs to draw images on computer screens and printers.

GDI+ was first released as part of the Windows XP operating system, and this latest security fix gets top priority because it is so widely used, security experts say. “If you are running XP, 2003 or 2008, you are going to need an update,” Storms said via instant message.

Five months ago, hackers targeted a flaw in the older version of GDI, used by Windows 2000 systems. In these attacks, criminals placed maliciously crafted images on Web sites, which were designed to exploit the GDI flaw and install unauthorized software on the victim’s machine.

Although Microsoft has not heard of anyone taking advantage of these latest GDI+ bugs in an attack, now that the software patches are available, hackers can probably reverse-engineer one of the flaws and develop new code that exploits the bugs, Storms said.

In its other Windows updates, Microsoft fixed vulnerabilities in the Windows Media Encoder 9, which is not included in the default Windows configuration, and Windows Media Player 11. Media Player 11 is the latest version of the audio and video player that ships with Windows. The Windows Media Encoder 9 is downloaded as part of the beta code for the Advanced Windows Media Plug-In for Adobe Premier 6.5, Microsoft said.

Although several of September’s bugs look like they could be used to create some nasty attacks, they primarily affect Windows desktops rather than servers, said Eric Schultze, chief technology officer at Shavlik Technologies. “So your servers sitting in the data center, you’re way less at risk with those,” he said. “Worry most abut the computers where people are sitting in front of the keyboard.”

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.