Microsoft Corp. on Tuesday released a fix for the underlying code execution vulnerability affecting users of its flagship Internet Explorer browser.
As part of its monthly patching cycle, Microsoft shipped three security bulletins, all rated critical, including patches for a bug in the JView Profiler (Javaprxy.dll) that was being exploited via the IE browser.
The July batch of patches also includes fixes for serious hole in the widely deployed Microsoft Word desktop productivity program and the color management module in the Windows operating system.
The JView Profiler fix, addressed in MS05-037, sets the killbit for the Javaprxy.dll COM object to prevent a malicious hacker from exploiting the vulnerability.
The flaw was first discovered and reported in late June, and Microsoft had previously released a downloadable killbit package to disable the affected control.
“When we first mobilized last week, we realized that we could put out that [killbit] download immediately. During the investigations, we determined that the Javaprxy.dll being loaded to IE was never meant to be loaded,” said Stephen Toulouse, program manager in the Microsoft Security Response Center.
“The killbit became the proper solution,” Toulouse said in an interview with Ziff Davis Internet News.
According to the Microsoft bulletin, the flaw could be remotely exploited by an attacker to take complete control of an affected system. “Since the JView Profiler COM object was not designed to be accessed through Internet Explorer, this update sets the killbit for the JView Profiler (Javaprxy.dll) COM object.”
If an IE user is logged on with administrative user rights, Microsoft warned that an attacker could exploit the flaw to install programs; view, change, or delete data; or create new accounts with full user rights. “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights,” the company said in the bulletin.
The software giant also provided patches for a “critical” vulnerability in Microsoft Word 2000, Microsoft Word 2002 and the Microsoft Works productivity suite.
The MS05-035 bulletin described the issue as a font parsing vulnerability that could allow an attacker to launch malicious code remotely to take “complete control” of the affected system.
Microsoft Office 2003 Word and Microsoft Office Word 2003 Viewer are not affected by this vulnerability.
A third “critical” bulletin, MS05-036, provides patches for a bug in the color management module found in default installations of the Windows operating system. The flaw exists in the way that the module handles ICC profile format tag validation.
“An attacker could exploit the vulnerability by constructing a malicious image file that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message,” Microsoft said in the bulletin.
Microsoft also re-released the MS05-033 bulletin to add Telnet client security updates for UNIX 2.0 and UNIX 2.1.
The company also updated its Windows Malicious Software Removal tool to add detections for variants of Wootbot, Optix, Optixpro, Hacty (also known as YYTHAC), and Prustiu (also known as Delf.FN).
