Patch Tuesday brings Word relief at last
Security fixes also reveal serious flaw in OneCare and Defender.
Microsoft's monthly Patch Tuesday security release has yielded the expected 12 patches, including several
covering a number of the Office bugs that have been exploited for some time. The release also contains a patch
for a 'critical' flaw in the software behind several of Microsoft's security products, including anti-virus
software Windows Live OneCare and spyware-blocker Windows Defender.
Two of the patches, MS07-014 and
MS07-015, each cover several
vulnerabilities in Word and other Office document formats, many of which have been used as vectors
for attack with a number of publicly known exploit techniques thought to be in use by hackers. MS07-015 is a
replacement for a previous patch, itself replacing an earlier version, which has been shown to have failed to
properly fix the problem in question. The numerous Office bugs, and the length of time taken to fix them,
have brought considerable criticism of Microsoft's patching
policy.
'These fixes have certainly been a long time coming,' said
John Hawes, Technical Consultant at Virus Bulletin. 'Sometime
soon Microsoft is going to have to see sense and start getting patches out there faster, rather than expecting
users to wait weeks or even months before they can protect themselves against attacks using flaws in these major
products.'
Another of the batch of fixes, MS07-010,
fixes a severe flaw in the PDF document handling of the Microsoft Malware Protection Engine, a component in
OneCare, Windows Defender, and gateway products Antigen and Forefront. A maliciously
crafted PDF could be used to gain remote access to a machine running any of these products; users of multi-engine
products Antigen and Forefront are advised to disable the Microsoft engine and rely on detection
from other providers until the patch is applied.
A summary of all the patch releases, with links to more details and downloads of the patches themselves, is
here.
14 February 2007
Tags:
del.icio.us 
digg this
This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details.