Feeds

Six patches - three critical - in MS August patch batch

Sys admin summer hols put on hold for patching

Security for virtualized datacentres

Microsoft's patch bandwagon rolled into town yesterday loaded with three critical updates among a total of six security alerts. A cumulative security update for Internet Explorer (MS05-038), a buffer overflow vulnerability in Windows Plug-and-Play (MS05-039) and a security bug in the Print Spooler service (MS05-043) all pose a severe hacker risk and earn Redmond's dreaded critical sobriquet.

Of particular note is a flaw in IE's JPEG image rendering that creates a means for virus writers to infect vulnerable systems simply by tricking users into viewing a malicious constructed image. The same IE mega-patch is also designed to address an error in the way COM objects are launched which could lead to memory corruption problems and a validation error revolving around the interpretation of certain URLs that creates scripting risks.

That's bad enough but the Plug-and-Play vulnerability is arguably even worse. Security vendor eEye notes that the vulnerability with Windows Plug-and-Play is similar to vulnerabilities historically exploited to create worms such as Blaster and Sasser. Security tools vendor ISS is even more stark in its warning.

"This vulnerability is remotely exploitable in the default configuration of Windows 2000, and is present in all modern Windows operating systems. There is a high probability that this vulnerability will be exploited in an automated fashion as part of a worm on Windows 2000," it said.

The three criticals encompass XP, Win 2003 and Win 2000 so just about everyone running Windows will have some patching work to do. Microsoft also re-releasing MS05-023 on Tuesday to reflect the fact that Microsoft Word 2003 Viewer is also affected by a vulnerability rated as critical.

Redmond also issued an "important" security update covering a vulnerability in Windows telephony service that could allow remote code execution (MS05-040). Finally we have two "moderate" bulletins covering a DoS risk involving flaws Window's Remote Desktop Protocol (MS05-041) and bugs in Microsoft's implementation of the Kerberos security protocol (MS05-042).

US CERT has produced a useful overview of these various security vulns here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.