Feeds

It's 2014 and Microsoft Windows PCs can still be owned by a JPEG

Update now: OS, Internet Explorer and (of course) Flash all in line for fixes

Security for virtualized datacentres

Patch Tuesday Microsoft has fixed security bugs in Internet Explorer and Windows that allow hackers to remotely execute code on victims' vulnerable machines – one bug a result of poor JPEG handling.

Redmond said the March edition of Patch Tuesday – out today, natch – tackles programming errors in the software giant's web browser, operating system and Silverlight package. Users should update their systems as soon as possible:

  • Patch bulletin MS14-012 fixes one publicly disclosed vulnerability and 17 privately reported vulnerabilities in Internet Explorer versions 6 through to 11 on all supported versions of Windows except the core installations of Windows Server 2008 and 2012. A malicious web page could exploit any of these holes to execute arbitrary code as the logged-in user, mainly by tricking IE into accessing memory it shouldn't.
  • Patch bulletin MS14-013 sorts out a flaw in the Windows DirectShow component, which incorrectly processed JPEGs allowing a maliciously crafted image to execute code on the victim's machine once opened. All supported versions of Windows are at risk except for Windows Server 2008 for Itanium and Windows RT.
  • Patch bulletin MS14-015 addresses a privilege escalation flaw in the kernel-level wink2k.sys component of Windows. A hacker could exploit this bug to gain administrator access on Windows XP, Server 2003, Vista, Server 2008, Windows 7, Server 2008 R2, and Windows 8 and 8.1, Server 2012, Windows RT and RT 8.1.
  • Patch bulletin MS14-016 closes a hole in Windows' Security Account Manager Remote Protocol that could allow someone to bypass security checks "if an attacker makes multiple attempts to match passwords to a username", suggesting the system is vulnerable to brute-force attacks. It affects all supported builds of Windows XP, Server 2003, Vista, Server 2008, and Server 2012.
  • Patch bulletin MS14-014 squashes a security bug in Silverlight that allows miscreants to bypass security protections – Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) – to make it easier to exploit other bugs.

Microsoft credited 23 outside researchers in helping to root out and report the IE flaws, exploits for which do exist, we're told. Discovery of the DirectShow cock-up was credited to VeriSign's iDefense Labs.

Adobe, meanwhile, is advising users to update Flash after the company released an update for the media plugin on Windows, OS X and Linux. That patch addresses a pair of security flaws that could allow attackers to bypass security protections or view the contents of a user's clipboard.

Adobe credited discovery of the flaws, which have not yet been targeted in the wild, to researchers Jordan Milne and Masato Kinugawa. Users can obtain the update through Adobe's download site or by updating their copies of Chrome and Internet Explorer to the latest stable releases. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.