We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,678 News Articles

Microsoft patches IE, Outlook and Word flaws

Four critical fixes in October's Patch Tuesday

Microsoft yesterday released six security updates. In October's 'Patch Tuesday' Microsoft fixed critical flaws in Word, Outlook Express, IE (Internet Explorer) and the Kodak image viewer that ships with Windows.

The Microsoft updates fix nine bugs in Microsoft's products. In addition to the four critical updates, Microsoft also released "important" fixes for the Windows SharePoint collaboration software and in the Windows RPC (remote procedure call) technology.

Get the latest PC security news, reviews and updates at Security Advisor

Nine updates is one less than originally expected. Last Thursday, Microsoft said it was planning to fix an unnamed flaw in Windows 2000 and Windows Server 2003 that could be used for "spoofing". That update was not included in Tuesday's patches.

Microsoft pulled this Windows patch because of a "quality control issue", the company said in a statement. It's not unheard of for Microsoft to make such last-minute decisions. The SharePoint update that was released on Tuesday had previously been pulled from the September updates for similar reasons.

The Word vulnerability may be of particular concern.

That's because it has been exploited by attackers, according to Christopher Budd, security program manager with Microsoft's Security Response Center. "We're aware of very limited and targeted attacks, but the issue itself has not been publicly disclosed," he said.

The bug can be exploited when an attacker tricks a victim into opening a maliciously-crafted Word document. It was reported to Microsoft sometime during the past three months, Budd said. This type of attack has been used many times over the past few years, exploiting bugs in a variety of Microsoft Office products. These attacks have been launched at a small number of select victims, often within government.

Though the Windows RPC flaw apparently cannot be exploited to run unauthorised software on a victim's machine, security experts consider it one of the most important patches released on Tuesday. RPC service has been the source of many virulent computer worms in the past, including 2003's Blaster, according to Amol Sarwate, manager of Qualys' vulnerability research lab.

"Whenever there is a denial of service there is always a chance of remote code execution," he said. However, even if hackers could find a way to use this bug to run unauthorised software on a PC, RPC is typically blocked at the firewall. This means that even if a worm could be crafted, it would have difficulty spreading.

Sarwate said that the IE patch, which fixes four bugs in the browser, should be moved to the front of the line by system administrators. That's because IE is so widely used and some of the bugs in the browser are very likely to be used in online attacks.

Even users who have removed Outlook Express from their PCs should install this month's critical patch for this software, according to Microsoft's Budd. "The files in question are part of the core operating system, so what we tell people is if the bits in question are on the box then you should apply the security update."

The IE patch is the most critical, agreed Andrew Storms, director of security operations with nCircle Network Security. According to him, an address spoofing flaw that was patched in this update has been known publicly for three months. "The URL spoof has been known since at least July and it's the perfect tool for a phisher," he said via instant message.

As for what Storms would patch after installing the IE update? "Second on my list is pretty much a tie between everything else minus the SharePoint vulnerability," he wrote.


IDG UK Sites

Top 5 Android tips and tricks for smartphones and tablets

IDG UK Sites

How to join Apple's OS X Beta Seed Program: Get OS X Yosemite on your Mac before public release

IDG UK Sites

Why the BBC iPlayer outage was caused by a DDoS attack: Topsy and Tim isn't *that* popular

IDG UK Sites

BBC using Glasgow 2014 Commonwealth Games to trial 4K/UHD, pan-around video, augmented video and...