News

Microsoft's Gonzo Patch Tuesday

• By Stephen Swoyer
• February 13, 2007

Office users can rest easy -- to a degree: Today's patch haul includes fixes for a bevy of Word exploits (four in all) and at least one known Excel exploit. The Word exploits, for the record, have been in the wild for more than two months now.

Six of the new updates address "critical" issues, including Word- and Office-related Remote Code Execution vulnerabilities; a Remote Code Execution vulnerability in Microsoft Data Access Components (MDAC); a remote code execution vulnerability in Microsoft's Malware Protection Engine; and a cumulative security update for Microsoft Internet Explorer.

The long-awaited fixes for Microsoft's Office vulnerabilities will probably snag the lion's share of virtual ink, but flaws in Microsoft's MDAC implementation -- a frequent source of exploits in the past -- are significant, too.

Microsoft acknowledged flaws in MDAC version 2.5 (SP3) for Windows 2000 (SP4); MDAC version 2.8 (SP1) on Windows XP SP2; and MDAC version 2.8 on Windows Server 2003, for both 32-bit x86 and 64-bit Itanium systems. Some MDAC versions -- such as MDAC 2.8 on both Windows XP Professional x64 Edition and Windows Server 2003 SP1 (for 32-bit x86 systems and both 64-bit x86- and Itanium-based systems) -- aren't susceptible to the vulnerability.

According to Microsoft, any affected system that runs Internet Explorer could be susceptible to attack. The attack vector in this case -- as in many other exploits -- involves enticing a user to load a malicious Web site into IE.

Elsewhere, Microsoft's Word roll-up patch addresses several different flaws: a Word Malformed String vulnerability, a Word Malformed Data Structures vulnerability, a Word Count vulnerability, a Word Macro vulnerability, a Word Malformed Drawing Object vulnerability and a Word Malformed Function vulnerability. All six flaws could allow Remote Code Execution, if successfully exploited, Microsoft officials acknowledge. All four known Word "zero-day" exploits -- which presumably take advantage of one or more of the flaws Microsoft disclosed this week -- involve Remote Code Execution.

The flaws affect Office 2000 SP3; Office XP SP3; Office 2003 SP2; Microsoft Office 2004 for Mac; and Microsoft Works Suites 2004, 2005, and 2006. The 2007 Office System, on the other hand, is not susceptible, Microsoft says.

Ditto for Microsoft's Office patch, which addresses a pair of vulnerabilities in PowerPoint and Excel. For the record, Microsoft disclosed a Malformed Record Memory Corruption vulnerability in PowerPoint and a Malformed Record vulnerability in Excel. The flaws affect:

• Office 2000 SP3
• Office XP SP3
• Office 2003 SP2
• Microsoft Project 2000 SR1
• Microsoft Project 2002 SP1
• Microsoft Visio 2002 SP2
• Microsoft Office 2004 for Mac

Microsoft's new 2007 Office System isn't susceptible to the vulnerabilities, nor -- the software giant adds -- is the PowerPoint Viewer it ships with Office 2003 SP2. Microsoft Works versions 2004, 2005 and 2006 also aren't affected by the vulnerabilities, officials confirmed.

The flaw in Microsoft's Malware Protection Engine is eerily similar to a flaw that anti-virus and security specialist Trend Micro Inc. acknowledged in its own AV scanning software last week. Microsoft says the vulnerability stems from the way its Malware Protection Engine parses Portable Document Format (PDF) files. The attack vector, once again, is familiar: A cracker crafts a malicious PDF file in such a way as to facilitate remote code execution when -- upon receipt (either via e-mail or IM attachment, download from a Web site, SMB file sharing or access from removeable media) -- the Microsoft Malware Protection Engine scans the PDF file.

The vulnerability affects Windows Live OneCare; Microsoft Antigen for Exchange 9.x; Microsoft Antigen for SMTP Gateway 9.x; Microsoft Windows Defender; Microsoft Windows Defender x64 Edition; Microsoft Windows Defender in Windows Vista; Microsoft Forefront Security for Exchange Server; and Microsoft Forefront Security for SharePoint. There are no mitigating factors, officials say.

Rounding out the list of "critical" bulletins is a flaw in Microsoft's HTML Help ActiveX Control that affects Windows 2000 SP4; Windows XP SP2; Windows XP Professional x64 Edition; Windows Server 2003 SP1 (for both 32-bit x86 and 64-bit x86/Itanium systems). The attack vector here as in other cases involves enticing a user to load a malicious Web site into IE.

Windows Vista is not affected by the vulnerability, Microsoft says.

Microsoft today also announced six additional updates that address "Important" issues: a vulnerability in its Step-by-Step Interactive Training that could allow Remote Code Execution; Elevation of Privilege vulnerabilities in Windows Shell and Windows Image Acquisition Services; a Remote Code Execution vulnerability in Microsoft OLE Dialog; a Remote Code Execution vulnerability in Microsoft Foundation Classes; and a Remote Code Execution Vulnerability in Microsoft RichEdit.

Finally, Microsoft announced another update for its Windows Malicious Software Removal Tool.

Today's patch Tuesday haul makes good, more or less, on what Microsoft promised to deliver in last Thursday's Advance Notification.

This isn't always the case, however: the MSRC has pulled patches in the past -- including last month, when several planned updates were yanked from its Patch Tuesday payload.