Thread Rating:
  • 5 Vote(s) - 1.8 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Help Microsoft's holiday bonus: Fixes for 40 flaws
Microsoft today patched 40 vulnerabilities in Windows, Internet Explorer (IE), Office, SharePoint and Exchange, including nine pegged "critical."

Five of the 17 security updates -- Microsoft calls them "bulletins" -- fixed long-standing flaws that could be used by attackers to plant malware on a PC by tricking Windows into thinking a malicious DLL (dynamic link library) was actually a legitimate part of the OS.

Only two of the 17 updates were judged critical, Microsoft's top-most threat ranking in its four-step scoring system. Another 14 were marked "important," the second-highest rating, while the remaining update was labeled "moderate."

Microsoft put the spotlight on the two critical bulletins, as did several security experts.

"Both MS10-090 and MS10-091 are pretty critical, I think," said Andrew Storms, director of security operations for nCircle Security. "Microsoft's evaluation seems in line with what I would expect, and shows that they're giving a pretty fair and balanced representation of priorities."

Amol Sarwate, manager of Qualys' vulnerabilities research labs, agreed with Storms, putting those updates at the top of his list, too.

MS10-090 patches seven vulnerabilities in IE, six of them critical and one marked moderate. All supported versions, including 2009's IE8, are affected by one or more of the bugs. IE9, which is still in beta testing, does not harbor any of the seven vulnerabilities, Microsoft said in its advisory.

Among the patched IE bugs were three that had been publicly disclosed before today, and one that hackers have been exploiting for at least the last six weeks.

Microsoft confirmed the latter on Nov. 3 in a security advisory, but was unable to craft and test a patch in time to make it into that month's security update.

MS10-091, which in Microsoft's eyes is a Windows update, also affected browsers -- but not IE directly.

Instead, attackers could exploit the three vulnerabilities in the update -- all rated critical -- through non-Microsoft browsers that support the open-source OpenType font format by simply tricking users into visiting a malicious site.

Microsoft did not list the affected browsers, but the other four of the top five -- Firefox, Chrome, Safari and Opera -- all support OpenType fonts.

It's unclear today whether those browsers need to be patched separately, and if so whether they have been patched. For its part, Microsoft said it had reached out to the other browser makers to let them know about the OpenType bugs it was addressing.

Opera Software, whose security team co-reported one of the three OpenType vulnerabilities to Microsoft, said that other browsers did not need repair.

"The patch for Opera is the referenced Microsoft [MS10-091] patch, as it is not possible for the [browser] to protect itself against the problem, except by disabling webfonts, since the problem is in the OS's handling of fonts," said Thomas Ford, an Opera spokesman.

Read more -
Thanks given by:

Possibly Related Threads…
Thread Author Replies Views Last Post
  General News: Microsoft is bringing Android App support to Windows 10: Report nairrk 0 339 11-30-2020, 06:43 PM
Last Post: nairrk
  General News: Microsoft Edge now the second most popular web browser, says study nairrk 0 220 08-04-2020, 06:29 PM
Last Post: nairrk
  General News: Microsoft Windows 10 May 2019 Update announced; will put you in control of updates nairrk 0 679 04-06-2019, 11:47 AM
Last Post: nairrk
  General News: Microsoft Office 2019 released for Windows and Mac nairrk 0 759 09-25-2018, 12:33 PM
Last Post: nairrk
  General News: Microsoft Teams chat service now comes with a free tier to take on Slack nairrk 0 690 07-13-2018, 01:37 PM
Last Post: nairrk
  General News: Microsoft just teased dark mode for nairrk 0 670 07-06-2018, 07:14 AM
Last Post: nairrk
  General News: Microsoft Edge on Android gets Adblock+ integration & some performance improvements nairrk 1 809 06-26-2018, 10:44 AM
Last Post: nairrk
  General News: Microsoft launches ‘Visual Search’ on its mobile apps including Bing, Microsoft.. nairrk 0 804 06-22-2018, 12:46 PM
Last Post: nairrk
  General News: Microsoft News, the revamped MSN news is rolling out for Windows 10, iOS, Android.. nairrk 0 645 06-21-2018, 11:20 AM
Last Post: nairrk
  General News: Microsoft acquires student video discussion platform Flipgrid nairrk 0 768 06-19-2018, 02:45 PM
Last Post: nairrk

Forum Jump:

Users browsing this thread: 1 Guest(s)