Microsoft addresses several critical flaws

By Robert Westervelt | Oct 19, 2009

1 comments

Digg

 Email

 Print

Microsoft issued 13 security bulletins Tuesday -- eight of them rated critical -- addressing zero-day flaws in Microsoft Server Message Block (SMB). Microsoft's regular update cycle fixed a record 34 vulnerabilities in Windows, Internet Explorer and Microsoft Office.

Security experts warned that users should work to get the SMB and IIS patches implemented immediately because attackers have already had access to the exploit code. In September exploit code surfaced on several websites targeting vulnerabilities in both the SMB and IIS; Microsoft issued an advisory recommending users deploy a workaround while its engineers produced and tested a fix.

Josh Phillips, a virus researcher at Kaspersky Lab called the SMB vulnerabilities the most alarming of the bulletins released Tuesday. In a statement, Phillips said the flaws were introduced as part of a Microsoft patch issued in 2007.

"What should be even more concerning for Microsoft, however, is the fact that the vulnerability affects Windows Vista and Windows 7 machines and not Windows XP, a peculiarity we would like not to be repeated," Phillips said.

In addition, the bulletins issued by Microsoft contained the first ever security update for the release-to-manufacturing version of Windows 7, addressing ActiveX control issues as a result of components built using a flawed version of Microsoft Active Template Library.

1 comments

Digg

 Email

 Print