Feeds

It's 2014 and Microsoft Windows PCs can still be owned by a JPEG

Update now: OS, Internet Explorer and (of course) Flash all in line for fixes

Beginner's guide to SSL certificates

Patch Tuesday Microsoft has fixed security bugs in Internet Explorer and Windows that allow hackers to remotely execute code on victims' vulnerable machines – one bug a result of poor JPEG handling.

Redmond said the March edition of Patch Tuesday – out today, natch – tackles programming errors in the software giant's web browser, operating system and Silverlight package. Users should update their systems as soon as possible:

  • Patch bulletin MS14-012 fixes one publicly disclosed vulnerability and 17 privately reported vulnerabilities in Internet Explorer versions 6 through to 11 on all supported versions of Windows except the core installations of Windows Server 2008 and 2012. A malicious web page could exploit any of these holes to execute arbitrary code as the logged-in user, mainly by tricking IE into accessing memory it shouldn't.
  • Patch bulletin MS14-013 sorts out a flaw in the Windows DirectShow component, which incorrectly processed JPEGs allowing a maliciously crafted image to execute code on the victim's machine once opened. All supported versions of Windows are at risk except for Windows Server 2008 for Itanium and Windows RT.
  • Patch bulletin MS14-015 addresses a privilege escalation flaw in the kernel-level wink2k.sys component of Windows. A hacker could exploit this bug to gain administrator access on Windows XP, Server 2003, Vista, Server 2008, Windows 7, Server 2008 R2, and Windows 8 and 8.1, Server 2012, Windows RT and RT 8.1.
  • Patch bulletin MS14-016 closes a hole in Windows' Security Account Manager Remote Protocol that could allow someone to bypass security checks "if an attacker makes multiple attempts to match passwords to a username", suggesting the system is vulnerable to brute-force attacks. It affects all supported builds of Windows XP, Server 2003, Vista, Server 2008, and Server 2012.
  • Patch bulletin MS14-014 squashes a security bug in Silverlight that allows miscreants to bypass security protections – Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) – to make it easier to exploit other bugs.

Microsoft credited 23 outside researchers in helping to root out and report the IE flaws, exploits for which do exist, we're told. Discovery of the DirectShow cock-up was credited to VeriSign's iDefense Labs.

Adobe, meanwhile, is advising users to update Flash after the company released an update for the media plugin on Windows, OS X and Linux. That patch addresses a pair of security flaws that could allow attackers to bypass security protections or view the contents of a user's clipboard.

Adobe credited discovery of the flaws, which have not yet been targeted in the wild, to researchers Jordan Milne and Masato Kinugawa. Users can obtain the update through Adobe's download site or by updating their copies of Chrome and Internet Explorer to the latest stable releases. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.