http://www.informationweek.com/news/showArticle.jhtml?articleID=206502000 By Thomas Claburn InformationWeek February 12, 2008 Microsoft (NSDQ: MSFT) on Tuesday released 11 Security Bulletins that address 17 potential vulnerabilities. Six of the Security Bulletins are rated critical; five are rated important. Microsoft did not include a fix for a JScript vulnerability that the company mentioned in its pre-patch guidance last week. The affected software includes WebDAV Mini-Redirector, Object Linking and Embedding (OLE) Automation, Microsoft Word, Internet Explorer, Microsoft Office Publisher, and Microsoft Office. The OLE and Word vulnerabilities affect both Microsoft's Windows and Mac customers. Components with important vulnerabilities include Active Directory/Active Directory Application Mode, Transmission Control Protocol/Internet Protocol (TCP/IP), Internet Information Services (IIS), and Microsoft Works File Converter. Symantec senior research manager Ben Greenbaum observed that Tuesday's round of fixes points to the increasing use of trusted sites to distribute malware. "While the batch of critical vulnerabilities all require some sort of user interaction to exploit, the interaction can be as simple as visiting a trusted Web site that has first been exploited by an attacker," he said in an e-mail. "As consumers and enterprises become more savvy to security risks, attackers are leveraging alternative means to distribute malware through these trusted sites in addition to distributing via an attachment or random link in an e-mail." "Six of the eleven are client-side vulnerabilities," said Eric Schultze, chief technology officer of Shavlik Technologies. "So if I open a malicious document or visit a malicious Web site, then I'm hacked. Those are always less interesting for me if I'm the attacker because I have to wait for someone to visit my site or open my document." Security bulletinsMS08-005 and MS08-006 relate to Microsoft's IIS Web server and Schultze says that taken together, these two vulnerabilities are more significant than Microsoft suggests. "Microsoft rates them important; I rate them critical," he said. "They allow me as the attacker to break onto your Web server and take complete control of it." Don Leatham, director of solutions and strategy at Lumension, said the Internet Explorer fix should be dealt with immediately. "We're definitely encouraging our customers at getting MS08-010 out as soon as possible," he said. "That looks like the one that has the most downside if some exploits were to come out quickly. It affects IE6 and IE7, which covers a lot of the browsers being used in a lot of organizations." "It was a surprise seeing such a large release on the heels of such a small release in January," said Jonathan Bitle, director of technical account management for Qualys. "After last month, people had a nice break. This just highlights the fact that organizations really can't rest in terms of security." Indeed, the absence of any fix for a high-profile Excel vulnerability suggests than even the most up-to-date systems will continue to have holes. ___________________________________________________ Subscribe to InfoSec News http://www.infosecnews.org/mailman/listinfo/isn
This archive was generated by hypermail 2.1.3 : Tue Feb 12 2008 - 23:38:38 PST