It seems like it was a busy month at Microsoft’s headquarter
and now the IT administrator will have some work to do. Today the software company
released 11 patches to fix 17 security vulnerabilities in all the Microsoft’s major
applications from Windows (including Windows Vista) to Visual Basic and
Internet Explores.
Microsoft rated six of the eleven updates as “critical”
which means they fix a vulnerability that could be remotely exploited.
The critical patches are related to Windows, Office and
Internet Explorer. For example MS08-007 addresses a flaw attackers could
exploit in the Windows WebDAV mini-redirector to hijack targeted machines and
install programs; view, change, or delete data; or create new accounts with
full user rights. The update affects all editions of Windows XP and Windows
Vista.
Another security bulletin, MS08-008 addresses a Windows flaw
attackers could exploit by tricking the user into viewing a Web site rigged
with malware. The flaw lies within the operating system's Object Linking and
Embedding (OLE) automation function and it was fixed in Windows 2000, Windows
XP, Windows Vista, Microsoft Office 2004 for Mac, and Visual Basic 6.
MS08-009 addresses a flaw attackers could exploit in
Microsoft Word to launch malicious code if a user opens an infected Word file,
while MS08-010 is a cumulative update for Internet Explorer, fixing several
flaws attackers could exploit to run malicious code on targeted machines when
the user views a specially crafted Web page using the browser.
The last two critical bulletins MS08-012 and MS08-013 were
issued to fix some flaws in Microsoft Office Publisher and Microsoft Office,
all editions.
The remaining five security updates were rated as important.
One of them addresses the flaws in implementations of Active Directory on
Microsoft Windows 2000 Server, Windows Server 2003.
For Windows Vista, Microsoft issued MS08-004, that fixes a
flaw attackers could exploit in Windows Vista's Transmission Control
Protocol/Internet Protocol (TCP/IP) processing function to stop the operating
system from responding and trigger a restart.
MS08-005 and MS08-006 address local and remote flaws
attackers could exploit in Internet Information Services (IIS) to hijack a
targeted machine.
However, Microsoft previously announce it will release 12
updates, but in the last minute the company dropped a fix for critical VBScript
and JScript flaws in Windows 2000, XP, and Windows Server 2003, because it
could put costumers at risk.
Last month, Microsoft released only two security bulletins.
