Microsoft plugs 15 holes, including critical drive-by bug

Expect exploits soon for Windows embedded font flaw, says researcher

Microsoft today patched 15 vulnerabilities in Windows, Windows Server, Excel and Word, including one that will probably be exploited quickly by hackers. None affect Windows 7, the company's newest operating system.

The 15 flaws fixed in Tuesday's six security updates were less than half the record 34 Microsoft patched last month in 13 separate bulletins. Of today's 15 bugs, three were tagged "critical" by Microsoft, while the remaining 12 were labeled as "important," the next-lowest rating in the company's four-step severity scoring system.

Experts agreed that users should focus on MS09-065 first and foremost. That update, which was ranked critical, affects all still-supported editions of Windows with the exception of Windows 7 and its server sibling, Windows Server 2008 R2.

"The Windows kernel vulnerability is going to take the cake," said Andrew Storms, director of security operations at nCircle Network Security. "The attack vector can be driven through Internet Explorer, and this is one of those instances where the user won't be notified or prompted. This is absolutely a drive-by attack scenario."

Richie Lai, the director of vulnerability research at security company Qualys, agreed. "Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver."

Both Storms and Lai were referring to the one bug marked critical in MS09-065, which actually patched a trio of vulnerabilities. According to Microsoft, the Windows kernel improperly parses Embedded OpenType (EOT) fonts, which are a compact form of fonts designed for use on Web pages. EOT fonts, however, can also be used in Word and PowerPoint documents.

Hackers could also launch attacks by attaching Word or PowerPoint documents to e-mail messages, then duping users into opening those documents.

In lieu of patching the problem, users can easily block the most likely attacks by disabling IE's support for embedded fonts. "That's a low-impact mitigation," Lai said. "The worst that could happen is that some sites might look ugly." His advice would still leave PCs open to attack via malicious Word or PowerPoint documents, a point Microsoft also made in the vulnerability's write-up.

Because Windows 7 and Windows Server 2008 R2 were not affected by the MS09-065 update, Storms and Lai assumed that Microsoft caught the bug before it wrapped up the final code, or release to manufacturing (RTM) build, of the operating system, and is only now getting around to plugging the holes in Windows 2000, XP and Vista, as well as Server 2003 and Server 2008.

"Windows 7 Release Candidate [RC] is probably vulnerable," said Storms, citing Microsoft's policy of not providing security updates for preview versions of an operating system when the final has been released. "That's why you don't see Microsoft patching Windows 7 RC or Beta," said Storms. "For anyone still running RC, they should take heed and upgrade to the RTM."

But while Storms speculated that Microsoft knew the EOT font flaw was a security issue -- and waited until now to patch older Windows -- Lai thought that Microsoft didn't realize until recently that it was also a security vulnerability in editions prior to Windows 7. "I think they fixed this bug as part of the code sanitization during [Windows 7's] development cycle. It was actually only publicly disclosed recently, and then they patched it in other Windows."

Microsoft acknowledged that information about the EOT vulnerability had gone public before today's patch. "While the initial report was provided through responsible disclosure, the vulnerability was later disclosed publicly by a separate party," stated the accompanying advisory.

Storms expects to see attackers jump on the EOT vulnerability. "This is the one to watch in the coming weeks, not only because of its novelty, but also because it can be exploited through IE, which is the easy route, as well as through Word and PowerPoint documents," he said.

Microsoft also issued critical updates for Vista and Server 2008 , as well as for Windows 2000 Server. On the latter, which harbors a bug in its implementation of the License Logging Server , a tool originally designed to help customers manage Server Client Access Licenses (CAL), Storms urged users of that aged operating system to apply the patch pronto, even though the machines are probably well-protected.

"Windows 2000 Server has the logging server enabled by default, but those systems are likely behind multiple firewalls, and people running [Windows 2000 Server] are pretty cognizant of the fact that it's an older version and will act accordingly."

Excel and Word also received patches today. Eight vulnerabilities were addressed in Excel in MS09-067 and one in Word with MS09-068 . Both updates also affected the Mac editions, Office 2004 and Office 2008.

"These are the kind of file format vulnerabilities we've seen many times before," said Storms, noting in a follow-up instant message that the bugs are in the older, binary file formats, not in the newer XML-based formats that Microsoft debuted in Office 2007 for Windows and Office 2008 for Mac.

This month's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftmicrosoft patchesPatch Tuesday

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Skywatcher Dobsonian 8″ Collapsible Telescope

Learn more >

Family Friendly

Whodunnit™ Duo-Scope MFL-007 Microscope Kit

Learn more >

Stocking Stuffer

Logitech Ultimate Ears Wonderboom 2 Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?