We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Microsoft patches two small but critical flaws

More patches from other vendors expected as a result

This month's Patch Tuesday security update from Microsoft featured just two 'critical' patches for applications in Windows and Office.

Industry watchers expect to see more patch updates from vendors other than Microsoft in response to Security Bulletin MS10-031.

Microsoft categorised this vulnerability as critical for all supported versions of Microsoft Visual Basic for Applications SDK and third-party applications that use Microsoft Visual Basic for Applications.

This security update is also rated 'Important' for all supported editions of Microsoft Office XP, Microsoft Office 2003, and the 2007 Microsoft Office System, the company stated in the bulletin.

"The vulnerability could allow remote code execution if a host application opens and passes a specially crafted file to the Visual Basic for Applications runtime. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system," according to Microsoft.

The issue for IT departments regarding this update is that third-party vendors could pass the vulnerability along in their applications. Also this vulnerability doesn't require significant action to be taken by end users to kick off malicious activity, according to Joshua Talbot, security intelligence manager, Symantec Security Response.

"I've put the Visual Basic for Applications vulnerability first on my list," Talbot said.

"The VBA vulnerability requires less action from a user. For instance, an attacker would simply have to convince a user to open a maliciously crafted file — likely an Office document — which supports VBA and the user's machine would be compromised. I can see this being used in targeted attacks, which are on the rise."

Defined as critical by Microsoft, MS10-030 addresses a privately reported vulnerability in Outlook Express, Windows Mail and Windows Live Mail.

The vulnerability could enable remote code execution if an end user visits a malicious e-mail server, according to Microsoft. The security risk addressed with this patch could quickly "crop up" again for IT departments, says Jason Miller, data and security team manager for Shavlik Technologies.

"With Windows Live Mail, a user could install Windows Messenger, which would ultimately land this on your system," Miller explains.

"Usually operating system patches apply to the base default operating systems, but this one has a series of cases in which it is not installed out of the box."

The attack vector for this vulnerability is still less likely to be exploited, according to Wolfgang Kandek, CTO of Qualys.

"Successful exploitation however is unlikely (exploitability index = 2 ) as it requires extensive user involvement including setting up an email account on a malicious server," Kandek said.

"We don't see Outlook Express/Windows Mail being used in the enterprise but smaller businesses could be affected."

See also: Two Windows & Office patches coming next week


IDG UK Sites

Best Black Friday 2014 tech deals: Get bargains on smartphones, tablets, laptops and more

IDG UK Sites

What the Internet of Things will look like in 2015: homes will get smarter, people might get fitter

IDG UK Sites

See how Trunk's animated ad helped Ade Edmondson plug The Car Buying Service

IDG UK Sites

Yosemite tips: Complete Guide to OS X Yosemite