Microsoft has three fixes for Windows vulnerabilities on tap for Patch Tuesday, but other security holes remain open.
Microsoft is kicking off 2011 with a
small Patch Tuesday release that will feature fixes for three vulnerabilities in Windows.
The bugs will be patched via two security bulletins, one of which is
rated "critical" and affects all supported versions of Windows. The
second bulletin, rated "important," only impacts Windows Vista.
Not included among the Patch Tuesday fixes for the month is a patch for the
Windows Graphics Rendering Engine the
company recently warned about. According to Microsoft, the Graphics
Rendering Engine bug can potentially be used by an attacker to run
arbitrary code. The bug was first revealed at a security conference in
December, and exploit code has recently been added to the Metasploit
Framework.
Also missing is a fix for an Internet Explorer vulnerability Microsoft
issued an advisory about in
December that exists due to the creation of uninitialized memory
during a Cascading Style Sheets (CSS) function within IE. Under
certain conditions, it is possible for an attacker to leverage the
memory to execute code remotely.
According to Microsoft, the issue impacts IE 6, 7 and 8.
"This month we will not be releasing updates to address
Security Advisory 2490606 (public vulnerability affecting Windows Graphics Rendering Engine) and
Security Advisory 2488013
(public vulnerability affecting Internet Explorer)," blogged Carlene
Chmaj, senior response communications manager for Microsoft Trustworthy
Computing.
"We continue to actively monitor both vulnerabilities and for
Advisory 2488013 we have started to see targeted attacks," Chmaj
continued. "If customers have not already, we recommend they consult
the Advisory for the mitigation recommendations. We continue to watch
the threat landscape very closely and if the situation changes, we will
post updates here on the MSRC blog."
Also unaddressed is the Internet Explorer vulnerability
uncovered by Google security engineer Michal Zalewski that was publicized earlier this week, as well as vulnerabilities impacting the Microsoft
WMI Administrative Tools WMI Object Viewer ActiveX Control security researchers warned about last month.
The Patch Tuesday updates are slated to be released Jan. 11.
Email
Print
