Microsoft Delivers Five Critical Security Patches

Published: November 15, 2006

by Alex Woodie

Microsoft published six patches for security problems in its software yesterday, including five patches fixing seven critical vulnerabilities in Windows and IE. Considering that two of the patches fix critical vulnerabilities that are being actively used to infect Windows users over the Internet, customers are encouraged to download and apply the updates as soon as possible.

Leading off this month's round of patches is Microsoft Security Bulletin MS06-067, a cumulative update for Internet Explorer that fixes a pair of critical vulnerabilities in the besieged browser, including the HTML Rendering Memory Corruption Vulnerability, which was being actively exploited over the Internet, and the DirectAnimation ActiveX Controls Memory Corruption Vulnerabilities. The two vulnerabilities were privately reported and aren't currently being harnessed for evil by malware writers.

Both of these vulnerabilities could lead to a computer being taken over entirely by a criminal; they affect IE 6 running on all current versions of Windows, except Windows Vista. IE 7 is not affected by this bug. Microsoft credits Sam Thomas, working with Zero Day Initiative and its parent company, TippingPoint (a subsidiary of 3COM) for alerting it to the presence of the HTML Rendering Memory Corruption Vulnerability.

Microsoft Security Bulletin MS06-068 fixes the critical Microsoft Agent Memory Corruption Vulnerability, which could lead to remote code execution on all versions of Windows, except Vista. Microsoft Agent is a technology provided to developers to enable them to embed "interactive personalities in the form of animated characters" into their applications or Web sites. Apparently, it also allowed ne'er-do-wells to corrupt the memory of unwitting victims who stumbled across the wrong Web page, but this is just a potential problem, as Microsoft says it was privately reported and not being actively exploited.

Users of Windows XP SP2 and Windows XP Pro X64 Edition should be especially aware of Microsoft Security Bulletin MS06-069, which fixes several critical problem in the way that Adobe Macromedia Flash files are consumed. Microsoft is fixing the problem, which is present in Macromedia Flash Player version 6.0.84.0 and earlier, because it distributes the program with new copies of Windows; Adobe, for its part, addressed the vulnerabilities with a patch more than two months ago. Microsoft credits Stuart Pearson of the UK security research and product development firm Computer Terrorism for helping it with this fix.

Users of Windows XP SP2 and Windows XP Pro X64 Edition should be especially aware of Microsoft Security Bulletin MS06-069, which fixes several critical problem in the way that Adobe Macromedia Flash files are consumed. Microsoft is fixing the problem, which is present in Macromedia Flash Player version 6.0.84.0 and earlier, because it distributes the program with new copies of Windows; Adobe, for its part, addressed the vulnerabilities with a patch more than two months ago. Microsoft credits Stuart Pearson of the UK security research and product development firm Computer Terrorism for helping it with this fix.

Microsoft Security Bulletin MS06-071 shuts down the potential for remote code execution on systems susceptible to the Microsoft XML Core Services Vulnerability, which is any version of Windows running XML Core Services versions 4 and 6 (versions 3 and 5 are not susceptible). The details of this vulnerability are publicly known, and exploit code is active in the wild. Microsoft credits Robert Freeman of IBM's Internet Security Systems subsidiary and Dror Shalev and Moti Jospeh of firewall maker Check Point for helping with this vulnerability.

Microsoft also included one security fix it deems important in the November bout of Patch Tuesday. Microsoft Security Bulletin MS06-067 fixes two problems related to Novell Netware-Windows interoperability, including the Client Service for NetWare Memory Corruption Vulnerability and the NetWare Driver Denial of Service Vulnerability. Both of these problems, which impact Windows 2000 SP4, Windows XP SP2, and Windows Server 2003 and its SP1 variant, were privately reported.

Microsoft will be hosting a Webcast today at 11 a.m. PST to discuss the current round of patches and to answer questions from customers. The Webcast is open to anybody and pre-registration is not required. For information on how to attend the Webcast, visit Microsoft's TechNet Security Center at www.microsoft.com/technet/security/default.mspx.