By Sharon Gaudin
May 8, 2007
In its monthly Patch Tuesday release, Microsoft today issued seven
advisories -- all rated critical -- that patch 19 vulnerabilities that
affect Windows, Office and Internet Explorer.
Three of the security bulletins handle bugs in Microsoft Office, with
one each for Windows, Microsoft Exchange and Internet Explorer. One of
the security bulletins also tackles a vulnerability in CAPICOM, which is
an ActiveX control, and BizTalk, which is a central Microsoft platform
for application integration.
Two of the vulnerabilities affect Microsoft's highly-touted Windows
Vista operating system, while six of them are bugs in various versions
of the company's ubiquitous browser, Internet Explorer. Five of the bugs
are in IE7.
Seven different vulnerabilities, according to the advisory, could lead
to code execution attacks against Word, Excel and Office.
"I think we are, in general, pleased because it does take care of a lot
of issues, especially the DNS server vulnerability," said Amol Sarwatee,
manager of vulnerability research labs at Qualys. "That was a zero-day
that was out in the wild being exploited. We were really expecting a
patch for it before today's patch Tuesday release."
The DNS issue was a zero-day vulnerability in several of Microsoft's
server products could enable a hacker to divert the Web traffic of not
just a single user but of a company's entire roster of employees.
Sarwatee called the DNS bug and the vulnerability in Exchange the most
critical out of all the flaws being patched today.
Symantec also pointed out the Exchange bug as one of the more critical
issues being fixed this month. The remote code execution vulnerability
affects the MIME (Multipurpose Internet Mail Extensions) decoding
mechanism of Microsoft Exchange Server, affecting versions 2000, 2003
According to a security bulletin from Symantec, for the attack on
Exchange to be successful, a user must open a malformed attachment. "A
successful attack could completely compromise the computer hosting the
vulnerable Exchange server and has the potential for impacting a large
audience," reported Symantec researchers.
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com