Microsoft patches 11 security issues, attacks underway

Share this article:

Microsoft on Tuesday delivered six patches to plug 11 holes in its products, including one vulnerability that hackers already are using to wage targeted attacks.

That flaw, present in Windows Common Controls, could result in remote code execution and affects many products, including Office and SQL Server. Microsoft rated this the top priority of the month and encouraged users to test and apply the "critical" patch (MS12-027) as quickly as possible.

Attackers currently are distributing the exploit via email attachments containing an RTF (rich text format) file, said Wolfgang Kandek, CTO of vulnerability management vendor Qualys.

Also of note was critical bulletin MS12-023, a cumulative update covering five vulnerabilities in all supported versions of Internet Explorer (IE). All of the bugs could result in an attacker obtaining the same rights as the user, but the worst of the flaws could end up in a user's machine becoming infected with malware if he or she is tricked into visiting a malicious web page.

Not fixed were the zero-day vulnerabilities that were used to hack IE 9 in the recent Pwn2Own challenge at the  CanSecWest conference in Vancouver, British Columbia, said Kandek.

Meanwhile, two other patches garnered critical status: MS12-024, which addresses a bug in the Windows Authenticode Signature Verification function, and MS12-025, which involves a flaw in the .NET Framework.

Concerning the former, John Harrison, group product manager of Symantec Security Response, said attackers can change portable executable files without being detected to spread malware. In an exploit scenario, tricksters likely would attempt to lure unsuspecting users to download a free program that appears to be legitimately signed.

"In addition, the attacker doesn't need to worry about controlling memory," he said. "Once the user runs the content, the device has been infected."

The remaining two patches, deemed "important," fixed holes in the Forefront United Access Gateway product, as well as Office.

To coincide with the Microsoft distribution, Adobe on Tuesday released its quarterly Acrobat and Reader update to address four critical vulnerabilities.

Share this article:

Sign up to our newsletters

More in News

AOL Mail hack furthers spam campaign using spoofed accounts

AOL confirmed on Monday that it was aware of the issue and working to remediate the situation.

Backdoors in Wi-Fi routers, said to be closed, can be reopened

Backdoors in Wi-Fi routers, said to be closed, ...

Although said to be patched, researcher Eloi Vanderbeken discovered during the Easter holiday that backdoors existing in certain wireless routers can be reactivated.

Apple ships Mac OS X updates, fixes several code execution bugs

Apple ships Mac OS X updates, fixes several ...

Among the addressed vulnerabilities, was a bug affecting WindowServer, which could allow an attacker to execute malicious code outside the sandbox.