Microsoft patches 11 security issues, attacks underway

Share this article:

Microsoft on Tuesday delivered six patches to plug 11 holes in its products, including one vulnerability that hackers already are using to wage targeted attacks.

That flaw, present in Windows Common Controls, could result in remote code execution and affects many products, including Office and SQL Server. Microsoft rated this the top priority of the month and encouraged users to test and apply the "critical" patch (MS12-027) as quickly as possible.

Attackers currently are distributing the exploit via email attachments containing an RTF (rich text format) file, said Wolfgang Kandek, CTO of vulnerability management vendor Qualys.

Also of note was critical bulletin MS12-023, a cumulative update covering five vulnerabilities in all supported versions of Internet Explorer (IE). All of the bugs could result in an attacker obtaining the same rights as the user, but the worst of the flaws could end up in a user's machine becoming infected with malware if he or she is tricked into visiting a malicious web page.

Not fixed were the zero-day vulnerabilities that were used to hack IE 9 in the recent Pwn2Own challenge at the  CanSecWest conference in Vancouver, British Columbia, said Kandek.

Meanwhile, two other patches garnered critical status: MS12-024, which addresses a bug in the Windows Authenticode Signature Verification function, and MS12-025, which involves a flaw in the .NET Framework.

Concerning the former, John Harrison, group product manager of Symantec Security Response, said attackers can change portable executable files without being detected to spread malware. In an exploit scenario, tricksters likely would attempt to lure unsuspecting users to download a free program that appears to be legitimately signed.

"In addition, the attacker doesn't need to worry about controlling memory," he said. "Once the user runs the content, the device has been infected."

The remaining two patches, deemed "important," fixed holes in the Forefront United Access Gateway product, as well as Office.

To coincide with the Microsoft distribution, Adobe on Tuesday released its quarterly Acrobat and Reader update to address four critical vulnerabilities.

Share this article:

Sign up to our newsletters

More in News

Russian hacker Seleznev ordered to remain in custody

Roman Seleznev's attorneys requested that the hacker be released on bond, but their pleas were rejected this past week.

Bug in iOS Instagram app fixed, impacts Facebook accounts

The vulnerability comes into play when Instagram users search for Facebook friends to "follow."

AP denied security docs on HealthCare.gov, a risk to private information

AP denied security docs on HealthCare.gov, a risk ...

The Associated Press was denied a request made under the Freedom of Information Act for documents that contain security information on HealthCare.gov.