Microsoft's Gonzo Patch Tuesday
- By Stephen Swoyer
- February 13, 2007
Microsoft Corp. today published 12 new security bulletins that address vulnerabilities
in its Windows, Office and Internet Explorer products.
Office users can rest easy -- to a degree: Today's patch haul includes fixes
for a bevy of Word exploits (four in all) and at least one known Excel exploit.
The Word exploits, for the record, have been in the wild for more than two months
Six of the new updates address "critical" issues, including Word-
Remote Code Execution vulnerabilities; a Remote Code Execution vulnerability
Data Access Components (MDAC); a remote code execution vulnerability in
Protection Engine; and a cumulative security update for Microsoft
The long-awaited fixes for Microsoft's Office vulnerabilities will probably
snag the lion's share of virtual ink, but flaws in Microsoft's MDAC implementation
-- a frequent source of exploits in the past -- are significant, too.
Microsoft acknowledged flaws in MDAC version 2.5 (SP3) for Windows 2000 (SP4);
MDAC version 2.8 (SP1) on Windows XP SP2; and MDAC version 2.8 on Windows Server
2003, for both 32-bit x86 and 64-bit Itanium systems. Some MDAC versions --
such as MDAC 2.8 on both Windows XP Professional x64 Edition and Windows Server
2003 SP1 (for 32-bit x86 systems and both 64-bit x86- and Itanium-based systems)
-- aren't susceptible to the vulnerability.
According to Microsoft, any affected system that runs Internet Explorer could
be susceptible to attack. The attack vector in this case -- as in many other
exploits -- involves enticing a user to load a malicious Web site into IE.
Elsewhere, Microsoft's Word roll-up patch addresses several different flaws:
a Word Malformed String vulnerability, a Word Malformed Data Structures vulnerability,
a Word Count vulnerability, a Word Macro vulnerability, a Word Malformed Drawing
Object vulnerability and a Word Malformed Function vulnerability. All six flaws
could allow Remote Code Execution, if successfully exploited, Microsoft officials
acknowledge. All four
known Word "zero-day" exploits -- which presumably take advantage
of one or more of the flaws Microsoft disclosed this week -- involve Remote
The flaws affect Office 2000 SP3; Office XP SP3; Office 2003 SP2; Microsoft
Office 2004 for Mac; and Microsoft Works Suites 2004, 2005, and 2006. The 2007
Office System, on the other hand, is not susceptible, Microsoft says.
Ditto for Microsoft's Office patch, which addresses a pair of vulnerabilities
in PowerPoint and Excel. For the record, Microsoft disclosed a Malformed Record
Memory Corruption vulnerability in PowerPoint and a Malformed Record vulnerability
in Excel. The flaws affect:
Microsoft's new 2007 Office System isn't susceptible to the vulnerabilities,
nor -- the software giant adds -- is the PowerPoint Viewer it ships with Office
2003 SP2. Microsoft Works versions 2004, 2005 and 2006 also aren't affected
by the vulnerabilities, officials confirmed.
The flaw in Microsoft's Malware Protection Engine is eerily similar to a flaw
that anti-virus and security specialist Trend Micro Inc. acknowledged in its
scanning software last week. Microsoft says the vulnerability stems from
the way its Malware Protection Engine parses Portable Document Format (PDF)
files. The attack vector, once again, is familiar: A cracker crafts a malicious
PDF file in such a way as to facilitate remote code execution when -- upon receipt
(either via e-mail or IM attachment, download from a Web site, SMB file sharing
or access from removeable media) -- the Microsoft Malware Protection Engine
scans the PDF file.
The vulnerability affects Windows Live OneCare; Microsoft Antigen for Exchange
9.x; Microsoft Antigen for SMTP Gateway 9.x; Microsoft Windows Defender; Microsoft
Windows Defender x64 Edition; Microsoft Windows Defender in Windows Vista; Microsoft
Forefront Security for Exchange Server; and Microsoft Forefront Security for
SharePoint. There are no mitigating factors, officials say.
Rounding out the list of "critical" bulletins is a flaw in Microsoft's
HTML Help ActiveX Control that affects Windows 2000 SP4; Windows XP SP2; Windows
XP Professional x64 Edition; Windows Server 2003 SP1 (for both 32-bit x86 and
64-bit x86/Itanium systems). The attack vector here as in other cases involves
enticing a user to load a malicious Web site into IE.
Windows Vista is not affected by the vulnerability, Microsoft says.
Microsoft today also announced six additional updates that address "Important"
issues: a vulnerability in its Step-by-Step
Interactive Training that could allow Remote Code Execution; Elevation of
Privilege vulnerabilities in Windows
Shell and Windows
Image Acquisition Services; a Remote Code Execution vulnerability in Microsoft
OLE Dialog; a Remote Code Execution vulnerability in Microsoft
Foundation Classes; and a Remote Code Execution Vulnerability in Microsoft
Finally, Microsoft announced another update for its Windows Malicious Software
Today's patch Tuesday haul makes good, more or less, on what Microsoft promised
to deliver in last Thursday's Advance
This isn't always the case, however: the MSRC has pulled patches in the past
-- including last month, when several planned updates were yanked
from its Patch Tuesday payload.