Microsoft plugs 15 holes, including critical drive-by bug

Expect exploits soon for Windows embedded font flaw, says researcher

Microsoft today patched 15 vulnerabilities in Windows, Windows Server, Excel and Word, including one that will probably be exploited quickly by hackers. None affect Windows 7, the company's newest operating system.

The 15 flaws fixed in Tuesday's six security updates were less than half the record 34 Microsoft patched last month in 13 separate bulletins. Of today's 15 bugs, three were tagged "critical" by Microsoft, while the remaining 12 were labeled as "important," the next-lowest rating in the company's four-step severity scoring system.

Experts agreed that users should focus on MS09-065 first and foremost. That update, which was ranked critical, affects all still-supported editions of Windows with the exception of Windows 7 and its server sibling, Windows Server 2008 R2.

"The Windows kernel vulnerability is going to take the cake," said Andrew Storms, director of security operations at nCircle Network Security. "The attack vector can be driven through Internet Explorer, and this is one of those instances where the user won't be notified or prompted. This is absolutely a drive-by attack scenario."

Richie Lai, the director of vulnerability research at security company Qualys, agreed. "Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver."

Both Storms and Lai were referring to the one bug marked critical in MS09-065, which actually patched a trio of vulnerabilities. According to Microsoft, the Windows kernel improperly parses Embedded OpenType (EOT) fonts, which are a compact form of fonts designed for use on Web pages. EOT fonts, however, can also be used in Word and PowerPoint documents.

Hackers could also launch attacks by attaching Word or PowerPoint documents to e-mail messages, then duping users into opening those documents.

In lieu of patching the problem, users can easily block the most likely attacks by disabling IE's support for embedded fonts. "That's a low-impact mitigation," Lai said. "The worst that could happen is that some sites might look ugly." His advice would still leave PCs open to attack via malicious Word or PowerPoint documents, a point Microsoft also made in the vulnerability's write-up.

Because Windows 7 and Windows Server 2008 R2 were not affected by the MS09-065 update, Storms and Lai assumed that Microsoft caught the bug before it wrapped up the final code, or release to manufacturing (RTM) build, of the operating system, and is only now getting around to plugging the holes in Windows 2000, XP and Vista, as well as Server 2003 and Server 2008.

"Windows 7 Release Candidate [RC] is probably vulnerable," said Storms, citing Microsoft's policy of not providing security updates for preview versions of an operating system when the final has been released. "That's why you don't see Microsoft patching Windows 7 RC or Beta," said Storms. "For anyone still running RC, they should take heed and upgrade to the RTM."

But while Storms speculated that Microsoft knew the EOT font flaw was a security issue -- and waited until now to patch older Windows -- Lai thought that Microsoft didn't realize until recently that it was also a security vulnerability in editions prior to Windows 7. "I think they fixed this bug as part of the code sanitization during [Windows 7's] development cycle. It was actually only publicly disclosed recently, and then they patched it in other Windows."

Microsoft acknowledged that information about the EOT vulnerability had gone public before today's patch. "While the initial report was provided through responsible disclosure, the vulnerability was later disclosed publicly by a separate party," stated the accompanying advisory.

Storms expects to see attackers jump on the EOT vulnerability. "This is the one to watch in the coming weeks, not only because of its novelty, but also because it can be exploited through IE, which is the easy route, as well as through Word and PowerPoint documents," he said.

Microsoft also issued critical updates for Vista and Server 2008 , as well as for Windows 2000 Server. On the latter, which harbors a bug in its implementation of the License Logging Server , a tool originally designed to help customers manage Server Client Access Licenses (CAL), Storms urged users of that aged operating system to apply the patch pronto, even though the machines are probably well-protected.

"Windows 2000 Server has the logging server enabled by default, but those systems are likely behind multiple firewalls, and people running [Windows 2000 Server] are pretty cognizant of the fact that it's an older version and will act accordingly."

Excel and Word also received patches today. Eight vulnerabilities were addressed in Excel in MS09-067 and one in Word with MS09-068 . Both updates also affected the Mac editions, Office 2004 and Office 2008.

"These are the kind of file format vulnerabilities we've seen many times before," said Storms, noting in a follow-up instant message that the bugs are in the older, binary file formats, not in the newer XML-based formats that Microsoft debuted in Office 2007 for Windows and Office 2008 for Mac.

This month's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityMicrosoftmicrosoft patchesPatch Tuesday

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?