Microsoft patches 11 security issues, attacks underway

Share this article:

Microsoft on Tuesday delivered six patches to plug 11 holes in its products, including one vulnerability that hackers already are using to wage targeted attacks.

That flaw, present in Windows Common Controls, could result in remote code execution and affects many products, including Office and SQL Server. Microsoft rated this the top priority of the month and encouraged users to test and apply the "critical" patch (MS12-027) as quickly as possible.

Attackers currently are distributing the exploit via email attachments containing an RTF (rich text format) file, said Wolfgang Kandek, CTO of vulnerability management vendor Qualys.

Also of note was critical bulletin MS12-023, a cumulative update covering five vulnerabilities in all supported versions of Internet Explorer (IE). All of the bugs could result in an attacker obtaining the same rights as the user, but the worst of the flaws could end up in a user's machine becoming infected with malware if he or she is tricked into visiting a malicious web page.

Not fixed were the zero-day vulnerabilities that were used to hack IE 9 in the recent Pwn2Own challenge at the  CanSecWest conference in Vancouver, British Columbia, said Kandek.

Meanwhile, two other patches garnered critical status: MS12-024, which addresses a bug in the Windows Authenticode Signature Verification function, and MS12-025, which involves a flaw in the .NET Framework.

Concerning the former, John Harrison, group product manager of Symantec Security Response, said attackers can change portable executable files without being detected to spread malware. In an exploit scenario, tricksters likely would attempt to lure unsuspecting users to download a free program that appears to be legitimately signed.

"In addition, the attacker doesn't need to worry about controlling memory," he said. "Once the user runs the content, the device has been infected."

The remaining two patches, deemed "important," fixed holes in the Forefront United Access Gateway product, as well as Office.

To coincide with the Microsoft distribution, Adobe on Tuesday released its quarterly Acrobat and Reader update to address four critical vulnerabilities.

Share this article:

Sign up to our newsletters

More in News

Two plead guilty for roles in separate Android app piracy groups

Two members of different Android app piracy groups pleaded guilty this week to conspiracy to commit criminal copyright infringement.

Pentagon to triple its security workforce by 2016

Pentagon to triple its security workforce by 2016

Defense Secretary Chuck Hagel recently announced the recruitment efforts during a speech in Fort Meade, Md.

Tech manufacturer's online payment system breached

LaCie confirmed an unauthorized party used malware to access its online payment system for almost a year and could have stolen customer information.