Microsoft issues 11 security bulletins covering 25 security vulnerabilities across its products.
Microsoft issued patches April 13 to cover 25 security holes across Windows,
Office and Exchange.
of the 11 security bulletins
issued were rated critical, and Microsoft is
calling administrators' attention to three in particular: MS10-026, MS10-027
and MS10-019. All three vulnerabilities can leave users open to remote code
execution by attackers. They affect Microsoft MPEG Layer-3 audio codecs,
Windows Media Player and Windows Authenticode Verification, respectively.
is very interesting as well as disturbing," said Jason Miller, data and
security team leader at Shavlik Technologies, explaining that an attacker
could use the two vulnerabilities the bulletin addresses to bypass digitally
"An attacker can modify the signed file and not invalidate the digital
signature," Miller said. "It is very common to rely on a digital
signature to verify the integrity of the file. If the signature is valid, the
file came from the original source, making this a simple and secure
process. However, with this vulnerability, attackers can trick people into
thinking the file is valid. With this bulletin, systems will have two
patches required to fix this vulnerability, which are Authenticode Signature
Verification and Cabinet File Viewer Shell Extension."
MS10-019 scored a 2 on the company's exploitability index, while MS10-026
and MS10-027 received a 1, Microsoft's highest rating. Microsoft warned
that the vulnerability in the MPEG
Layer-3 audio codecs
(MS10-026) could be exploited via malicious AVI file
with an MPEG Layer-3 audio stream. While Windows 7, Windows Server 2008 R2 and
the Itanium versions of Windows Server 2003 and 2008 are not affected, the
bulletin is critical for Windows 2000, Windows XP, and Server 2003 and 2008
fixes a critical Windows Media Player vulnerability that could allow
remote code execution if a user opened specially crafted media content hosted
on a malicious Website. The bug only impacts Windows 2000 and XP users.
The other critical bulletins cover a vulnerability in Microsoft Windows
Services running on Windows 2000 Server and a vulnerability in the SMB protocol
the company warned users about in November. Also among the fixes is a bug
rated important that affects
and that Microsoft issued an advisory about in March.