Today is Patch Tuesday and that means Microsoft Security released its monthly list of updates. This month, it sends out four critical fixes for Windows Media Player, Microsoft Windows GDI+, Windows Media Encoder 9 Series, Microsoft Office.
The Windows Media Player affects the Media Player and also Windows and could allow remote code execution if a malicious audio file is streamed from a Windows Media server while a user is logged on to a PC with administrative rights.
The GDI+ vulnerability affects Microsoft Windows, Internet Explorer, .NET Framework, Office, SQL Server, Visual Studio. The hole could allow remote code execution if a user viewed a malicious image file using the affected software, or browsed a Web site that contained the malicious content.
This hole in Windows Media Encoder 9 Series affects Windows and could allow remote code execution if a user viewed a malicious Web page. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system, Microsoft warns.
The Office fix involves a vulnerability in OneNote. If a user clicks on a malicious OneNote URL it could allow an attacker to take complete control. Microsoft does not specify that a user must be logged on as an admin in order for an attacker to take advantage of this hole.
According to a Network World article, the GDI+ hole, MS08-052, is the most troublesome patch for users because it touches so many pieces of software and attacks deep within Windows. Users need only visit a Web site with a malicious image and they are PWN’d. The story says:
“Fifty-two addresses five vulnerabilities and affects the core operating system,” says Amol Sarwate, manager of the vulnerabilities research lab at Qualys. “It affects .bmp, .wmf, and .gif [image] file formats, and an attacker could either send such files as e-mail attachments or have a victim view a malicious Web page.”
Also see Microsoft patches will put IT on hunt for affected systems
Visit the Microsoft Subnet home page for more news, blogs, podcasts.More blog post from the Microsoft Subnet posts:
* 10 questions for virtual world evangelists (Microsoft’s) Zain Naboulsi, and (G-Squared’s) Kyle Gomboy* Adventures in Benchmarking: How fast is Hyper-V?5 ways cloud providers mess up*
Subscribe to all Microsoft Subnet bloggers via Yahoo Pipes. bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)Sign up for the
