Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Microsoft has patched for 15 vulnerabilities with the distribution of six bulletins, one of which the software giant recommends administrators immediately apply.That fix, MS09-065, corrects three vulnerabilities in Windows kernel-mode drivers. One of the flaws is considered "critical", but does not impact Vista or Server 2008.The bug, however, can be exploited on Windows 2000, XP and Server 2003 machines to execute remote code if a user views content rendered in a maliciously-crafted Embedded OpenType font, used on web pages. Proof-of-concept code is already available to launch drive-by attacks, security researchers said yesterday. And, according to Microsoft, consistent exploit code is expected."We recommend customers prioritize and deploy this update immediately," Jerry Bryant, senior security program manager at Microsoft, wrote on the company's Security Response Center blog.Ben Greenbaum, senior research manager at Symantec, agreed that the bulletin should be urgently deployed because the flaw is at the kernel level, meaning it does not matter with what privilege the user's machine is running."All that's required of a user to become infected by it is simply viewing a compromised web page," he said. "Symantec isn't seeing any active exploits of this in the wild yet, but we think attackers will be paying a lot of attention to it in the future."Tuesday's update also includes two other "critical" bulletins, which address four vulnerabilities, and three "important" bulletins that take care of 10 bugs. One of those -- MS09-067 -- resolves eight flaws in Office that can lead to remote code execution if a user opens a specially-crafted Excel file.Sheldon Malm, senior director of security strategy at Rapid7, a vulnerability management provider, called MS09-067 a "sleeper threat" because Microsoft considers it highly exploitable and because Excel is widely used.Also, as part of the update, Microsoft re-released two patches: MS09-045 and MS09-051. See original article on scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.
