Office and Mail bugs star in May Patch Tuesday update
Devil in the detail
Microsoft released just two updates on Tuesday as part of a light patch Tuesday, especially in comparison with April's 11 bulletins.
May's batch contains a fix (MS10-030) for a critical vulnerability in Windows Outlook Express, Windows Mail and Windows Live Mail. Left unchecked, the vulnerability created a mechanism for remote code execution.
In practice, however, a fair bit of user interaction would probably be needed to pull off an attack. Even though Redmond defines the update as critical the vulnerability is not being actively exploited by hackers. It affects applications most frequently used by consumers and small businesses.
The second bulletin (MS10-03) covers a remote code execution flaw in supported versions of Microsoft Office, and is labelled as "important".
A recently discovered vulnerability in Microsoft's SharePoint enterprise portal software was not addressed by the latest batch of security updates. Wolfgang Kandek, CTO at vulnerability scanning firm Qualys, commented: "We recommend looking into the advisory and implementing the suggested work-around which restricts the access to the Help functionality in SharePoint."
Alan Bentley, VP International for Lumension, warned that newly discovered vulnerabilities in third-party browser software pose a threat to Windows users.
“A new Safari vulnerability that impacts Windows remains un-patched and Proof of Concept Code (POC) is freely downloadable on the Internet. The biggest concern here is that Safari is often installed silently when a user chooses to install QuickTime on their Windows PC," Bentley said.