MS patches three critical security problems

Microsoft released the second installment of its now monthly security bulletins, patching three software holes in Windows systems that it said were "critical" security risks and a fourth problem with Microsoft Office that the company rated "important."

Taken together, the security holes could allow attackers to set up Web pages to take advantage of vulnerable systems and read files or run attack code on a remote user's Windows machine, Microsoft said.

One bulletin, MS03-049, affects Windows 2000 and Windows XP workstations and fixes a critical buffer overrun vulnerability in a Windows service called the Workstation Service, which manages requests for files or printing services on a local area network. That service is turned "on" by default in Windows and could be compromised by an attacker using an improperly formatted network message that was sent to a vulnerable machine.

A second bulletin, MS03-051, patches two critical problems that were discovered in Microsoft's FrontPage Server Extensions, which are installed by default with the Internet Information Services (IIS) on certain versions of Windows 2000 and allows technical staff to create, manage and add features to Web pages.

Microsoft said that it fixed a buffer overrun in the FrontPage Server Extensions that could enable an attacker to place and run attack code on a vulnerable machine, as well as a flaw in the way that a component called SmartHTML interpreter works that made it vulnerable to denial of service attacks.

The company also issued a new cumulative security patch, MS03-048, for the Internet Explorer (IE) Web browser. The new patch updates previous cumulative patches for IE and sews up five new vulnerabilities in the product, including a problem with the browser's cross domain security model, which governs how different Web sites share information and interact with the Windows operating system.

The fourth patch, MS03-050, fixes a security hole in some versions of Microsoft's Excel spreadsheet and Word word processing products that could enable an attacker to embed an attack in a small program known as a macro. Machines running vulnerable versions of those products could have malicious code placed and run on their Windows system after opening an infected spreadsheet or Word document, Microsoft said.

While all the security holes disclosed by Microsoft deserve prompt attention from network administrators, the Workstation Service and FrontPage Server Extensions vulnerabilities are particularly serious, according to Vincent Gullotto, vice president of McAfee AVERT at Network Associates.

The problem with the Workstation Service that Microsoft identifies in MS03-049 could be particularly troublesome for network administrators, because it affects every Windows 2000 and Windows XP machine, rather than less-plentiful servers, and because the vulnerability could allow attackers to launch their attack without any user interaction, Gullotto said.

MS03-051 is also dangerous, given the widespread use of Internet Information Server and the ability of attackers to remotely exploit the security hole and compromise vulnerable machines, he said.

Although Microsoft did not rate the Microsoft Office security hole critical, that too could be an attractive target for attackers, Gullotto said.

Attacks that use macros are less common than they used to be, he said. However a vulnerability such as the one disclosed in MS03-050 that allows remote code execution and the rich supply of systems running affected versions of Microsoft Excel and Microsoft Word could prompt hackers to write proof-of-concept code for the vulnerability that could then be used in attacks, Gullotto said.

Microsoft only last month switched to a system of releasing monthly security bulletins, replacing a system of weekly security updates.

The company made the change in response to complaints from Microsoft customers about the difficulty of staying on top of the weekly releases, Microsoft said.

Microsoft said it reserves the right to release bulletins at any time, however, and will do so when it feels customers are in imminent danger of being attacked because of a known software vulnerability.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?