Patch Tuesday Yields Four Patches for 10 Vulnerabilities

Published: January 10, 2007

by Alex Woodie

Microsoft's security team yesterday picked up where it left off in 2006 when it issued four patches covering 10 vulnerabilities, including three fixes for critical zero-day vulnerabilities in Windows and Office. The number of patches would have been twice as high had Microsoft not pulled four patches at the last minute, raising the likelihood of an out-of-band release of fixes by Microsoft later this month, according to a security expert.

So far, not much has changed security-wise in the new year, according to Amol Sarwate, manager of the vulnerability lab at security software company Qualys. "Two trends that started late last year are still going strong, including the increase in zero-day vulnerabilities, and second, an increase in client-side issues. All of these [patches released by Microsoft this week] are client-side issues," he says.

Most of the problems fixed yesterday--as well as the problems that Microsoft chose not to address yet--involve zero-day exploits, Sarwate says. The good news is that, while the vulnerabilities could lead to remote code execution, most of them require user interaction. That means they aren't "wormable," in that they could be used to create worms that propagate by themselves across the Internet without any input from the user, according to Sarwate.

The bad news is that there are still unpatched vulnerabilities in Windows, Office, and Visual Studio that attackers could use to launch attacks. When Microsoft sent out its patch notifications early last week, it said there would be eight patches. However, the company quickly followed up on that initial report last Thursday or Friday and said there would be only four patches.

The cancellation of the patches was likely due to quality issues, Sarwate says. "We know they have four patches they wanted to release that they did not release," he says. "It's just a matter of time before somebody researches and exploits them. I would expect an out-of-band release from Microsoft."

Here's a rundown on the patches that were released yesterday:

• Microsoft Security Bulletin MS07-001 fixes a remote code execution problem, deemed "important," in the Portuguese version of Office 2003 distributed in Brazil. A data validation problem with the grammar checker in Word could allow an attacker to take complete control of an affected system if a user opened a malformed document, either through e-mail or over the Web. Microsoft says that, although this vulnerability had been publicly disclosed, it was not aware of any actual attacks using this vulnerability.
• Microsoft Security Bulletin MS07-002 fixes five critical vulnerabilities in the versions of Excel that ship with Office 2000, Office XP, Office 2003, Microsoft Works Suite 2004 and 2005, and Office 2002 and Office v.X for Mac. Like the Word problem addressed with MS07-001, these series of vulnerabilities could enable an attacker to take complete control of a system if a user opened a malformed spreadsheet. Microsoft says it's not aware of any attacks utilizing the vulnerabilities closed with this patch
• Microsoft Security Bulletin MS07-003 is a critical patch that fixes three vulnerabilities in all recent versions of Outlook, except the newest one that shipped with Office 2007. Without this patch, users expose themselves to remote code execution or denial of service attacks. According to Sarwate, this patch closes the most severe problems--specifically the iCal vulnerability--disclosed this Patch Tuesday. "That is the one we've seen some activity, as far as hackers attempting to use that vulnerability," he says.
• Microsoft Security Bulletin MS07-004 fixes another problem discovered in the Vector Markup Language (VML) component of Windows 2000, Windows XP, and Windows Server 2003. Microsoft first addressed a problem in VML with a rare out-of-cycle patch in September, and this patch expands on the earlier patch to fix a newly discovered vulnerability relating to the Windows implementation of VML.

Microsoft isn't the only vendor that should be concerned about the security of its software. According to Sarwate, a problem with Adobe's ubiquitous PDF software has yet to be fixed, and could cause harm among both consumers and businesses. Among business software, unpatched vulnerabilities in CA's Backup Exec software could also cause problems.

For more information on the recent patches or to register for today's Web cast at 11 a.m. PST, go to www.microsoft.com/technet/security/default.mspx.

RELATED STORIES

Microsoft Patches Two Zero-Day Exploits, Leaves Two Untouched

Microsoft Issues Out-of-Cycle Patch for VML Flaw

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot