Microsoft fixes critical Windows, Word flaws

Patch Jet Database bug pronto, say researchers; exploits in circulation

Although Sarwate of Qualys echoed Storms -- "it is a little confusing," he said, referring to the information about Jet Database in the Word bulletin -- he said fixing it on Windows' end was not only the most important part of the exploit chain to patch, but the only patch really necessary.

MS08-026 patches a pair of critical bugs in how Word and Outlook render RTF (rich text format) files and documents with Cascading Style Sheets (CSS). Microsoft pegged the flaws as critical in Word 2000 and Outlook 2007, and "important" -- the second-highest threat rating in the company's four-step system -- in Word 2002, 2003 and 2007, as well as in the versions of Word included with Office 2004 for Mac and Office 2008 for Mac.

Another bulletin, MS08-027, patches a vulnerability in several versions of Microsoft Publisher, the company's consumer- and small business-grade desktop publishing program. Although Microsoft designated the fix as critical, Sarwate downplayed the patch as nothing new. "This is just another of the kind we've seen in the past year where client-side applications are being targeted," he said.

The fourth security update, however, caught both Sarwate's and Storms' attention. MS08-029 quashes two bugs in Microsoft's anti-malware scanning engine, which is used by a whole host of Microsoft security apps, including Windows Live OneCare, Microsoft Antigen, Windows Defender and Microsoft's Forefont line.

Sarwate disagreed with Microsoft's "moderate" ranking of the two bugs. "That may work for the immediate consequences, but if you think of the impact of closing down your anti-virus, you're basically exposing yourself to viruses and all sorts of bad stuff," he said. "I think it should have been at least one level up, to 'important'," said Sarwate.

Storms also noted that it was possible that an attack aimed at Microsoft's vulnerable security products could make a system, a server, for example, unbootable.

"One of the two vulnerabilities talks about 'disk space exhaustion'," said Storms. "When an anti-virus scanner scans a file, it usually creates a temp file in a safe zone and scans it there. This bug could cause the scanner to open so many temp files that it would exhaust the available disk space. That makes this a little more interesting than Microsoft says, because if the system doesn't clean itself up as it crashes, [the attack] could render the machine unbootable."

Sarwate also reminded users that Microsoft didn't deliver on one expected patch. "Last month, on April 17, Microsoft issued an advisory that talked about a zero-day it called an elevation of privilege bug," said Sarwate.

Almost a month ago, Microsoft warned of a bug that could give attackers significantly greater access to Windows XP Professional SP2, and all versions of Windows Server 2003, Windows Vista and Windows Server 2008. The flaw could be exploited through custom Web applications running in Microsoft's Web server, Internet Information Services (IIS), or via SQL Server, added Microsoft.

May's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?