Feeds

Six patches - three critical - in MS August patch batch

Sys admin summer hols put on hold for patching

Top 5 reasons to deploy VMware with Tegile

Microsoft's patch bandwagon rolled into town yesterday loaded with three critical updates among a total of six security alerts. A cumulative security update for Internet Explorer (MS05-038), a buffer overflow vulnerability in Windows Plug-and-Play (MS05-039) and a security bug in the Print Spooler service (MS05-043) all pose a severe hacker risk and earn Redmond's dreaded critical sobriquet.

Of particular note is a flaw in IE's JPEG image rendering that creates a means for virus writers to infect vulnerable systems simply by tricking users into viewing a malicious constructed image. The same IE mega-patch is also designed to address an error in the way COM objects are launched which could lead to memory corruption problems and a validation error revolving around the interpretation of certain URLs that creates scripting risks.

That's bad enough but the Plug-and-Play vulnerability is arguably even worse. Security vendor eEye notes that the vulnerability with Windows Plug-and-Play is similar to vulnerabilities historically exploited to create worms such as Blaster and Sasser. Security tools vendor ISS is even more stark in its warning.

"This vulnerability is remotely exploitable in the default configuration of Windows 2000, and is present in all modern Windows operating systems. There is a high probability that this vulnerability will be exploited in an automated fashion as part of a worm on Windows 2000," it said.

The three criticals encompass XP, Win 2003 and Win 2000 so just about everyone running Windows will have some patching work to do. Microsoft also re-releasing MS05-023 on Tuesday to reflect the fact that Microsoft Word 2003 Viewer is also affected by a vulnerability rated as critical.

Redmond also issued an "important" security update covering a vulnerability in Windows telephony service that could allow remote code execution (MS05-040). Finally we have two "moderate" bulletins covering a DoS risk involving flaws Window's Remote Desktop Protocol (MS05-041) and bugs in Microsoft's implementation of the Kerberos security protocol (MS05-042).

US CERT has produced a useful overview of these various security vulns here. ®

Security for virtualized datacentres

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.