MS Publisher, Windows Flaws Patched

By Ed Oswald | Published September 12, 2006, 5:31 PM

While today's Patch Tuesday featured a patch for every level of importance -- one "critical," one "important," and one "moderate -- experts are saying the bigger story is what was not fixed. Notably missing was a patch for the recently publicized zero-day exploit for Word 2000.

"Microsoft did not release a patch for the zero day exploit in Microsoft Word, and it could be another month before the patch becomes available," Chris Andrew said, who is vice president of security technologies for PatchLink, a company that produces software that assists IT administrators in ensuring their systems are fully updated.

Instead, the critical Office fix was for the much less commonly used Microsoft Publisher 2000, 2002 and 2003. According to an advisory, a remote code execution vulnerability exists within Publisher that could be exploited when the application parses a malformed string. An attacker would be able to take complete control of an affected system.

Two patches were issued for problems within Windows. The more severe of the two, rated "important," dealt with a flaw within the Pragmatic General Multicast (PGM) communications feature in Windows XP, which is only exploitable when an optional Microsoft Message Queuing Services (MSMQ) module is installed.

When exploited, the vulnerability could be used to launch a denial-of-service attack against the affected computer.

Finally, the least severe of the three patches was a moderate-rated fix for a vulnerability within the Indexing Service for most versions of Windows 2000, XP and Windows Server 2003. The flaw could allow an attacker to run client-side script on behalf of a user. The script could spoof content, disclose information, or take any action that the user could take on the affected Web site, Microsoft said.

Although the severity of the zero-day Word issue has been debated, Andrew still provided guidance to computer users on how to protect themselves until a patch is issued.

"The best option is for IT administrators to turn on safe mode in Microsoft Word or to use Microsoft Word Viewer to open e-mail attachments," he said. "IT administrators should evaluate their IT environment and make sure that a suitable firewall technology can control the inflow of documents."

Comments

View comments by with a score of at least

We have several problems here:
1. It's Microsoft's whim when we are patched.
2. Older products seem to not be as important to Microsoft.
3. The trusted computing initiative isn't working. I trust Microsoft less as time passes. I trust that they will patch slower and slower, and eventually they will be late after a massive worm hits, and their excuse? Quality Assurance.

Score: 0

|

Ahem,

Hem, hem, hem, Done! Right? Wrong!

As soon and I mean as soon as I was done with MS Windows Update with 5 updates totalling 5.5 mbs, this here computer (after restart) has slooooowed down considerably, too slow.

If it is that Malicious Software Remover tool, I'm getting it out asap.

Score: 0

|

Do you have Windows Desktop search installed and running at sartup? Since tuesday it's been taking up 100 meg of memory and hogging system resources. I've uninstalled it (never used it anyway) and now it's fine.

Score: 0

|

Microsoft's Ray Ozzie: 'Nobody's going to be 100% open'

The mobile apps ecosystems of the world may converge over time, led by apps being ported over across platforms, according to the Chief Software Architect.

Will Firefox beat IE9 to Direct2D rendering?

Just days after Microsoft executives gave conference attendees a peek at a new rendering technology, a Mozilla contributor revealed he's working on the same thing.

Where there's smoke: Apple warranty stance raises troubling questions

Carmi Levy | Wide Angle Zoom: Smoking can be dangerous not only for your lungs, it appears, but for your Apple hardware warranty.

The fallacy of Facebook privacy

Carmi Levy | Wide Angle Zoom: If an insurance company learns something interesting about its client through the Internet, is that snooping?

Microsoft 'worked with Apple' for Silverlight on iPhone, says Goldfarb

By not making such a big deal out of trying to stream video to the iPhone, Microsoft got a big deal out of it, revealed the Silverlight product manager.

Clicker.com cuts through the Web video chaos

In a world where homemade video and Hollywood movies travel the same pipeline, it's good to have a real search engine to cut through the clutter.

A case study in improving software: What Office 2010 can learn from Notion 3

A music composition product gambles with a complete overhaul, in an effort to make headway against two well-known competitors in a tough market.

Kindle 2 update adds battery life, native PDF reader

Amazon has pushed out an update to the Kindle 2 e-reader that lengthens battery life and adds a native PDF viewer.

Safari on iPhone gets competition from a $1 browser app

Apple likes to say it gives iPhone users a full browsing experience, but a new competitor tries to incorporate more desktop browser features.

Action Replay maker sues Microsoft for Xbox 360 'predatory technological barriers'

Third-party video game accessory maker Datel has filed an antitrust lawsuit against Microsoft over the Xbox 360's recent Dashboard update.