Microsoft has a small Patch Tuesday planned for this month. The company said it will ship two security bulletins May 11 to fix vulnerabilities in Windows, Office and Visual Basic for Applications. Both bulletins are rated critical and cover vulnerabilities that leave users open to remote code execution by attackers.
“Windows 7 and Windows Server 2008 R2 customers will be offered the Windows-related update but they are not vulnerable in their default configurations,” noted Jerry Bryant, group manager of Response Communications for Microsoft Security Response Center.
Missing from the lineup is a patch for a cross-site scripting flaw affecting Office SharePoint 2007 and Windows SharePoint Services 3.0 that was reported the week of April 26. Bryant said the company is still working on an update to address the issue, and recommended that users try the workaround contained in the advisory issued April 29.
The SharePoint vulnerability permits escalation of privileges within the SharePoint site. If an attacker successfully exploits the vulnerability, the attacker could run commands against the SharePoint server with the privileges of the compromised user.
According to Microsoft, Internet Explorer 8 users browsing to a SharePoint site in the Internet Zone are at a reduced risk because the XSS Filter in IE 8 prevents this attack by default. The XSS Filter is not enabled by default in the Intranet Zone, however.