Patch Tuesday misses Word bugs again
Excel, Outlook and VML flaws fixed, Word still left open.
Microsoft has issued its first Patch Tuesday set of security fixes, with three 'critical' issues
addressed. Problems with Excel, Outlook and the use of Vector Markup Language in
Internet Explorer, all of which could expose users to the execution of malicious code from remote sources,
have been covered by patches; however, several
problems found in
Microsoft Word remain wide open to exploitation, after several weeks in the public arena.
All the flaws involve memory corruption or buffer overflow problems. A fourth patch, fixing another memory
corruption issue involving the grammar checker in Brazilian Portuguese versions of Microsoft Office, has been
rated at the slightly lower level, 'important', due to the lower number of users affected; the vulnerability also
allows remote execution of arbitrary code.
Fortinet and iDefense are given some credit for discovering the multiple Excel vulnerabilities.
The VML issue follows an earlier problem in the same area, which caused some controversy after the release of a
third-party patch, and led Microsoft to break its usual monthly patch
cycle and issue an emergency fix.
'The Word patches are what everyone's waiting for,' said John Hawes,
Technical Consultant at Virus Bulletin. 'These flaws have been exploited in the wild for some time, let's hope
Microsoft breaks the cycle again and gets fixes out to users soon - before people lose all confidence in the
safety of their Office documents.'
Shortly before the release, Microsoft reduced the number of patches from eight included in an earlier
announcement. Revisions to the original advance notification were made with little explanation, leading to
speculation that the expected Word fixes were pulled during late testing. A fix for a Visual Studio
problem is also thought to have been among those dropped from this release.
The full security bulletin from Microsoft is
here, and a simplified home-user
version can be found here.
10 January 2007
Tags:
del.icio.us 
digg this
