Feeds

Office and Mail bugs star in May Patch Tuesday update

Devil in the detail

Choosing a cloud hosting partner with confidence

Microsoft released just two updates on Tuesday as part of a light patch Tuesday, especially in comparison with April's 11 bulletins.

May's batch contains a fix (MS10-030) for a critical vulnerability in Windows Outlook Express, Windows Mail and Windows Live Mail. Left unchecked, the vulnerability created a mechanism for remote code execution.

In practice, however, a fair bit of user interaction would probably be needed to pull off an attack. Even though Redmond defines the update as critical the vulnerability is not being actively exploited by hackers. It affects applications most frequently used by consumers and small businesses.

The second bulletin (MS10-03) covers a remote code execution flaw in supported versions of Microsoft Office, and is labelled as "important".

A recently discovered vulnerability in Microsoft's SharePoint enterprise portal software was not addressed by the latest batch of security updates. Wolfgang Kandek, CTO at vulnerability scanning firm Qualys, commented: "We recommend looking into the advisory and implementing the suggested work-around which restricts the access to the Help functionality in SharePoint."

Alan Bentley, VP International for Lumension, warned that newly discovered vulnerabilities in third-party browser software pose a threat to Windows users.

“A new Safari vulnerability that impacts Windows remains un-patched and Proof of Concept Code (POC) is freely downloadable on the Internet. The biggest concern here is that Safari is often installed silently when a user chooses to install QuickTime on their Windows PC," Bentley said.

Microsoft's summary of its May Patch Tuesday can be found here. The Internet Storm Centre's rather more readable overview is here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
State Dept shuts off unclassified email after hack. Classified mail? That's CLASSIFIED
Classified systems 'not affected' - but, is this reconnaissance?
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.