Microsoft's Patch Tuesday involves a single bulletin rated "critical" alongside two "important" ones. Affected software includes Windows and Office.
Microsoft's Patch Tuesday is a relatively minor one, with a single bulletin
rated "critical" and two "important." Affected software
includes applications within Windows and Office.
, rated "Critical," patches vulnerabilities in
DirectShow, Windows Media Player and Windows
In order for an outside entity to exploit said vulnerabilities, the user would
need to open a specially crafted Microsoft Digital Video Recording (DVR-MS)
"The lone critical issue this month-the DVR-MS vulnerability-will be
somewhat trivial for attackers to exploit," Joshua Talbot, security
intelligence manager for Symantec Security Response, wrote in a March 8 e-mail.
"It also allows attackers to skip a few of the traditional steps needed to
get malicious code to execute on a targeted computer. This is because when
processing DVR-MS files, Windows Media Player and Media
Center use data in these files
themselves to determine what code in memory gets executed."
The next "Important" update, MS11-017, patches a vulnerability in
Windows Remote Desktop Client that could allow remote code execution if a user
opens a Remote Desktop configuration file (.rdp) located in the same network
folder as a "specially crafted library file," according to Microsoft.
"For an attack to be successful, a user must visit an untrusted remote
file system location or WebDAV share and open a document from this location
that is then loaded by a vulnerable application."
The third update, MS11-016, is rated "Important" and aims to
resolve a vulnerability with Microsoft Groove. Similar to the vulnerability
patched by MS11-017, this one could allow an outside entity to remotely execute
code if a user opens a legitimate file in the same network directory as a
specially crafted library file.
"The other vulnerabilities fixed this month all relate to the DLL
issues Microsoft has been working to address for some time now," Talbot
added in his note. "These are fairly easy to exploit, but because an
attack would require to take some fairly uncommon steps-such as opening up
malicious files from SMB or WebDAV servers-they're less likely to pose a
This current Patch Tuesday update follows a far larger one in February,
which saw fixes for 22 vulnerabilities across a number of Microsoft software
platforms, including Windows, Internet Explorer, Microsoft Office and IIS. That
followed a relatively sedate January, which included only two security