Feeds

IE, Windows server bugs likely to be exploited soon

Yes, it's Microsoft Patch Tuesday again

Top 5 reasons to deploy VMware with Tegile

Microsoft has released 13 updates that patch security holes in a wide range of its software offerings, including vulnerabilities rated critical in its Internet Explorer browser and Windows server operating systems.

The bugs in IE make it possible for attackers to remotely execute malicious code when an end user does nothing more than visit a booby-trapped website. Although there's no evidence the vulnerabilities are being exploited in the wild now, members of Microsoft's security team said there was a high likelihood reliable exploit code would be developed by real-world attackers in the next 30 days.

The vulnerabilities affect all supported versions of the Microsoft browser, including versions 8 and 9, which were rebuilt from scratch to minimize the damage that can be done when hackers identify vulnerabilities.

The second critical update covers all versions of Windows Server 2003 and Windows Server 2008, including the most recent R2 iteration, which is regarded as one of Microsoft's most secure server operations systems ever. By setting up a malicious DNS server and getting a vulnerable system to query it from inside the victim's network, an attacker can take complete control of the underlying machine.

According to Microsoft's exploitability index for August, attackers aren't likely to exploit the DNS flaw in the next month.

The remaining 11 patches carry the lower-level ratings of important and moderate and affected products including Windows, Office, .Net, and Visual Studio. Vulnerable components include the Remote Desktop Web Access Login, Microsoft Chart Web Control, and the Report Viewer Web control. The vulnerabilities enable attacks involving information theft and and denial of service outages.

Roundups of this month's Patch Tuesday offerings from Microsoft and SANS are here and here. Commentary from Kaspersky Lab and Qualys is here and here. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.