Microsoft Delivers Seven Security Bulletins, Three Critical

Microsoft released seven security bulletins, including fixes for three critical vulnerabilities, as part of its monthly Patch Tuesday update delivered on Dec. 12.

The software giant, based in Redmond, Wash., shipped 11 security patches in total, including a cumulative Internet Explorer bulletin and an update meant to fix a flaw in the Windows Media file format.

The Windows Media update was unexpectedly added to the six bulletins the company said it would forward in its Patch Tuesday preview released on Dec. 8.

The Windows Media vulnerability targeted by the patch, along with a cumulative IE browser bulletin and an update meant to close a glitch in Microsofts Visual Studio 2005 software were identified as critical risks, the companys most severe security rating.

The IE bulletin may be considered the most severe of the critical patches, addressing a script error handling memory corruption in the browser that merited the critical status.

The client-side code execution vulnerability is caused by a memory corruption condition when handling script errors and the company said that computers affected by the glitch could allow for remote code execution and allow hackers to take control of systems running the software.

Microsoft said the critical flaw could be exploited using a specially-crafted Web page designed to attack the issue, which is present in its Internet Explorer 5 and 6, Windows 2000, Windows XP and Windows Server 2003 systems.

Also included in the IE bulletin were fixes for a critical DHTML script function memory corruption vulnerability residing in IE 6 and Windows XP that could allow for remote code execution if exploited.

Also, there were patches for a TIF folder information disclosure vulnerability ranked as important for almost all versions of the browser, and a second TIF folder information disclosure vulnerability that was rated as a moderate security risk.

Microsoft said the Virtual Studio 2005 patch is meant to fix a critical WMI object broker vulnerability in the development package that could allow for remote execution and allow an attacker who successfully exploits this flaw to take complete control of an affected system.

Double Trouble: Microsoft confirms another Word zero-day flaw. Click here to read more.

While the problem is present in all versions of the Virtual Studio 2005 software, Microsoft said that users running Internet Explorer on Windows Server 2003 in its default enhanced security configuration would not be affected by the issue.

The bulletin covering the Windows Media file format issue includes two individual patches aimed at closing critical issues in Microsofts Windows Media Player 6.4, Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows XP Professional x64 Edition, Windows Server 2003, Windows Server 2003 Service Pack 1 and Windows Server 2003 x64 Edition products.

One of the patches seeks to remedy a remote code execution vulnerability existing in Windows Media Format Runtime, due to the way it handles ASF (advanced systems format) files.

Next Page: Losing control of an affected system.