Microsoft Patches Five 'Critical' Flaws Patch Tuesday Addresses At Least 10 Vulnerabilities Ed Sutherland
Microsoft Windows and Office have the spotlight today, as the company released seven patches, five deemed critical, as part of its patch Tuesday.
In response to at least 10 vulnerabilities, the seven patches fixed security holes in consumer and enterprise software.
At the top of the critical list is security bulletin MS06-035, which addresses a vulnerability in Windows Server 2003, as well as Windows XP and Windows 2000. A security flaw in the Windows Server Service could allow remote code execution.
Another critical security patch, MS06-036, hopes to keep Windows computers online. A hole in the DHCP Client Service of both servers and Windows XP and Windows 2000 machines could prevent systems from connecting to the Internet.
Bulletin MS06-037 announces a patch that fixes a vulnerability permitting attackers to send malformed Excel files that later could be executed, taking control of a system, according to Jonathan Bitle, product manager of Qualys, a managed security company.
Two of the critical patches affect Office users.
For those running Office 2000, Service Pack 3, Microsoft released MS06-038, resolving two vulnerabilities, the most serious permitting remote code execution.
The second Office hole affects Project 2000 users. The patch, MS06-038 resolves two vulnerabilities in Office, the most serious of which could allow remote code execution.
Microsoft also released two patches marked "important."
In MS06-033, a vulnerability in ASP.NET could allow an attacker to gain access to information, such as filenames, in the Applications folder.
The flaw could not allow intruders to execute remote code or raise user rights, according to Microsoft.
The final Tuesday patch is MS06-034, which could allow attackers to wrest control of a Windows IIS server by uploading malformed .ASP Web pages.
Intruders would need to have valid logon information for the vulnerability to work, according to today's security notice.
Today's batch of security bulletins follows 12 security notices the company released last month.
That group of patches included fixes for Windows and Microsoft applications, including Windows Media Player, Internet Explorer, and Microsoft Outlook.
