Feeds

How's it going, Microsoft users? Patching your PCs? You SHOULD be

Five remote-code execution holes to plug – and two actively exploited

High performance access to file storage

Patch Tuesday Brace yourselves, users and administrators, Microsoft and Adobe have released another monthly batch of critical security updates for their products.

The December edition of Patch Tuesday will fix five critical vulnerabilities in Microsoft software, two which are being exploited in the wild by miscreants.

The first of the critical flaws lies within the handling of TIFF image files in Windows Vista, Server 2008, Lync and Office 2010, 2007 and 2003. If exploited, an attacker could use the bug to remotely execute code on the targeted system with full administrative rights.

The second critical fix addresses a flaw in the WinVerifyTrust security component which could be exploited to bypass code-signing protections in the operating system, thereby allowing an attacker to inject malicious code into a trusted executable that's run when the tainted program is unwittingly launched. This affects all supported versions of Windows and Windows Server. Microsoft said the bug has been exploited in the wild in targeted attacks.

Of the remaining updates from Microsoft, three are rated critical but have not yet been exploited in the wild. Those bulletins include fixes for remote-code execution flaws in the Scripting Runtime in all supported Windows, Internet Explorer and Exchange.

An additional six patches will address flaws that have been rated by Microsoft as "important". One of these bugs has been exploited in the wild and is a security bypass hole in Microsoft Office. Other fixes squash an information-disclosure bug in Office, the ability to elevate privileges on Windows using driver-level programming blunders, and a remote-code execution flaw in SharePoint.

You can find a summary of the updates over at Microsoft's security response blog.

Adobe, meanwhile, has issued its own monthly updates to remedy security vulnerabilities in Flash Player and Shockwave. The company said that both updates will close holes that, if exploited, could allow an attacker to remotely execute code on a targeted machine. Adobe recommends that all Windows, OS X and Linux users update their copies of Flash, Air and Shockwave in order to protect against attack.

Adobe made a point to emphasize that neither of the patches concern issues related to its customer database breach in October, which resulted in the leaking of sensitive account information. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.