We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Internet Explorer flaws fixed by Microsoft Patch Tuesday updates

Microsoft says Internet Explorer versions 6 through 10 are subjects of two critical Patch Tuesday updates for February that could address recent Java woes.

Both critical patches address vulnerabilities that could give attackers access to client browsers and from there access to the underlying host, says Alex Horan a senior product manager at CORE Security. "Bulletins 1 and 2 target all versions of Internet Explorer on essentially all versions of Windows platforms, so it's pretty much one-hack fits all in the Windows environment for attackers," he says. "I expect a lot of interest in developing a working exploit for this vulnerability."

[NEWS: Microsoft launches campaign against Gmail over privacy 

HELP: 11 (FREE!) Microsoft tools to make life easier 

NAVIGATE: 12 essential Windows 8 keyboard shortcuts]

Three less urgent patches ranked important could address flaws that enable the takeover of machines accessed via the Internet Explorer vulnerabilities, he says. "Bulletins 7, 8 and 9 seem to target the same underlying systems as Bulletins 1 and 2, which means hackers could phish users and then leverage 7, 8 and 9 to get system level control of their machines. That is essentially a worst case scenario and knockout punch for security personnel," Horan says.

Another security expert Paul Henry, a security and forensic analyst for Lumension, says the two critical Internet Explorer problems could be linked to Java. "It's possible that this is related to the recent and ongoing Java issues," he says. "Microsoft has a very close relationship with Oracle, so it wouldn't surprise me if these bulletins include Java patches."

Regardless, they put unpatched machines in danger of falling to remote code execution exploits, Microsoft says, and may require restarting affected machines, something that will make installing the patches a longer exercise.

There are 12 patches in all this month, an uptick from the past few months, and they affect a wide range of Windows platforms from Windows XP to Windows RT, the new Windows 8 tablet operating system that runs on ARM processors. "It's never a good sign when your current code base is impacted," Henry says. This month's 12 patches is the highest number since June 2011 when there were 16.

One remaining patch ranked important affects the FAST indexing server for SharePoint and is caused by an update to some Oracle libraries used for document conversion by Microsoft, says

The remaining bulletins are all rated important and are mostly "Local Elevation of Privilege" type of vulnerabilities, meaning that one already has to be on the targeted computer to be able to attack them. One exception is Bulletin 5, which can be used for Remote Code Execution. It affects the FAST Indexing server for SharePoint and it is also caused by Oracle's update of the Outside In libraries that are used by Microsoft for document conversion processes, says Wolfgang Kandek, CTO for Qualys.

Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at [email protected] and follow him on Twitter https://twitter.com/#!/Tim_Greene.)

Read more about wide area network in Network World's Wide Area Network section.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

Chromebooks: ready for the prime time (but not for everybody)

IDG UK Sites

Hands-on with Sony's latest smartglasses

IDG UK Sites

The 13 most inspirational Tim Cook quotes