Feeds

Your Microsoft critical security patches tonight

Remote compromise and privilege evaluation flaws land on Windows, again

  • alert
  • submit to reddit

The essential guide to IT transformation

Microsoft last night released three sets of security patches, the most important of which aims to address flaws in Microsoft Virtual Machine (VM) which it admits could enable system compromise.

The VM patch is designed to address eight vulnerabilities, the most serious of which would enable an attacker to gain control over a user's system. That's possible because of a vulnerability that means an untrusted Java applet could access COM objects.

Microsoft VM is a virtual machine for the Win32 operating environment and ships with most versions of Windows as well as in most versions of Internet Explorer, so many millions of users are potentially affected by the problem. Attack scenarios are all too familiar. To exploit the flaws an attacker would create a Web page that, when opened, exploits the desired vulnerability, and either host it or send it to a victim as an HTML mail.

No surprise then that Microsoft describes the patch (which can be found by following the link here) as critical.

Next up there's a patch for a privilege elevation flaw - a particular Windows message, called WM_TIMER. Because of this problem an attacker able to log onto a target machine could gain administrator privileges.

The issue affects Windows NT 4.0, NT 4.0 Terminal Server, Win 2K and Win XP. The big mitigating factor here is that the flaw looks far from easy to exploit, particularly because it doesn't lend itself to remote exploitation. For these reasons, Microsoft rates the flaw as important but not critical. There's more info on this problem here.

Lastly, while we're doing a bug roundup, we should mention a
"moderately severe" vulnerabilitywithin Windows Server Message Block (SMB) protocol which could enable group policy on domain controllers to be modified. Flaws in cryptographic signing implementation used by MS in SMB are the root cause of the problem. These flaws are fixed in Win XP SP1 or through a separate patch, released yesterday, which is designed to address the problem on Windows 2000 boxes.

That's all for now.

Have a nice day. ®

Related Stories

At a stroke, MS cuts critical vuln reports
IE hopelessly bug ridden
MS patches insecurity trio

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.