Fighting malware and spam

Patch Tuesday brings Word relief at last

Security fixes also reveal serious flaw in OneCare and Defender.

Microsoft's monthly Patch Tuesday security release has yielded the expected 12 patches, including several covering a number of the Office bugs that have been exploited for some time. The release also contains a patch for a 'critical' flaw in the software behind several of Microsoft's security products, including anti-virus software Windows Live OneCare and spyware-blocker Windows Defender.

Two of the patches, MS07-014 and MS07-015, each cover several vulnerabilities in Word and other Office document formats, many of which have been used as vectors for attack with a number of publicly known exploit techniques thought to be in use by hackers. MS07-015 is a replacement for a previous patch, itself replacing an earlier version, which has been shown to have failed to properly fix the problem in question. The numerous Office bugs, and the length of time taken to fix them, have brought considerable criticism of Microsoft's patching policy.

'These fixes have certainly been a long time coming,' said John Hawes, Technical Consultant at Virus Bulletin. 'Sometime soon Microsoft is going to have to see sense and start getting patches out there faster, rather than expecting users to wait weeks or even months before they can protect themselves against attacks using flaws in these major products.'

Another of the batch of fixes, MS07-010, fixes a severe flaw in the PDF document handling of the Microsoft Malware Protection Engine, a component in OneCare, Windows Defender, and gateway products Antigen and Forefront. A maliciously crafted PDF could be used to gain remote access to a machine running any of these products; users of multi-engine products Antigen and Forefront are advised to disable the Microsoft engine and rely on detection from other providers until the patch is applied.

A summary of all the patch releases, with links to more details and downloads of the patches themselves, is here.

14 February 2007

Tags:    del.icio.us   digg this

Quick Links

Poll

virusbtn: RT @emailsecmatters: The typical spam message has sources as diverse as the spam lunch meat: http://ht.ly/2yucd
2 hours ago

virusbtn: Can anyone write a rap about our RAP tests (http://bit.ly/255ySQ) and submit it to the Symantec competition http://bit.ly/bOJg8r
6 hours ago

Virus Bulletin

• VB100 – Windows Vista Business Edition Service Pack 2
• Apple pie order?
• Anti-unpacker tricks – part eleven
• Advanced exploit framework lab set-up
• HTML structure-based proactive phishing detection
• What’s the deal with sender authentication? Part 3