Feeds

Microsoft zero-days said to target Office and Windows

Another Patch Tuesday marred

Reducing security risks from open source software

Hot on the heels of yesterday's batch of updates from Microsoft patching five critical Windows vulnerabilities come reports of new zero-day exploits, some that appear to allow the commandeering of a PC. They underscore a growing pattern in which miscreants release their payloads shortly before or after Patch Tuesday.

According to an entry on the McAfee Avert Labs blog, "several" attacks exploiting weaknesses in Office were released in security forums on Monday. Also making the rounds is proof-of-concept code that attacks Windows.

Two of the flaws - one in Office and the other in Windows - involve heap overflow flaws and appear to allow the execution of code on a victim's machine. The Windows POC targets the handling of .HLP files. McAfee didn't provide details on the Office flaws, except to say that all but one appeared to result in a pesky, but much less critical, denial of service.

Microsoft says it is investigating the reports and isn't aware of any customers being targeted by the flaws. It also reiterated an advisory deeming .HLP files as unsafe unless the user is assured they are not malicious.

Among others, yesterday's patch binge fixed flaws in Universal Plug and Play, Windows CSRSS, Microsoft Agent and Microsoft Content Management Server. It also repaired a bug in last week's emergency patch of a critical hole in the way Windows processed animated cursors. Both the cursor vulnerability and CSRSS patch affected Windows Vista, which Microsoft has called its most secure operating system ever.

The simultaneous release of the patches and new zero-days is most likely not by accident. Malicious hackers know Microsoft is reluctant to issue out-of-schedule updates, so timing the release of malware around Patch Tuesday helps ensure a longer shelf life for their precious zero-day exploits. Prior to yesterday's report, Office already suffered from at least two zero-day vulnerabilities, according to eEye Security's zero-day tracker.

According to McAfee, the tally of patches released to date this year well exceeds the number for this time in 2006. Which either means the software behemoth is getting better at identifying and repairing flaws or its security assurances are only so much hot air. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.