We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
79,864 News Articles

Microsoft reports two bugs

And a third has been identified

Microsoft is warning of two bugs in its software that could potentially give unauthorised control over or access to a person's computer, while a third problem has been highlighted by a security research company.

One vulnerability revisits the Windows Metafile (WMF) debacle from December, but affects fewer users. The bug is in Internet Explorer 5.01 Service Pack 4 on the Windows 2000 Service Pack 4 OS and IE 5.5 Service Pack 2 on Windows Millennium, Microsoft said.

An attacker could gain control if a user opened a malicious email attachment or if a user were persuaded into visiting a website that had a specially crafted WMF image, Microsoft said.

A patch has not been issued, but Microsoft said the issue is under investigation, and an out-of-cycle patch could be provided, depending on customer needs. Microsoft typically issues patches on the second Tuesday of the month – the next releases are expected on 14 February.

A second vulnerability could allow a person with low user privileges to gain higher-level access, Microsoft said. Proof-of-concept code that has been released attempts to exploit overly permissive access controls on third-party application services, along with the default services of Windows XP Service Pack 1 and Windows Server 2003, the company said. No attacks have been reported.

Microsoft said several factors diminish the threat of the problem. Those running Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1 – the latest updates of the software – are not affected, and someone who launches an attack would need authenticated access to the affected OS, it said.

Security vendor Secunia has detailed a third vulnerability involving Microsoft's HTML Help Workshop, software that can create online help for a software application or website content.

Secunia said the problem is due to "a boundary error within the handling of a '.hhp' file that contains an overly long string in the 'contents file' field". This can be exploited to cause a stack-based buffer overflow and allows arbitrary code execution when a malicious '.hhp' file is opened, the firm said.

The bug could allow arbitrary code to be executed on a computer. An exploit has been released, and Secunia has advised that untrusted .hhp files not be opened.


IDG UK Sites

Samsung Galaxy Note 4 release date, price and specs UK: Is this the actual Note 4 - video

IDG UK Sites

How Apple, Adobe, Microsoft and others have let us down over UltraHD and hiDPI screens

IDG UK Sites

How Ford designs next-generation cars at its Melbourne Design Centre

IDG UK Sites

iPhone 6 release date, rumours, video, UK price & images: iPhone launch event confirmed for 9...