Security News > 2005 > January > Microsoft Patches Flaw in Service Pack 2

http://www.washingtonpost.com/wp-dyn/articles/A1504-2005Jan11.html By Brian Krebs washingtonpost.com Staff Writer January 11, 2005 Microsoft Corp. on Tuesday issued a trio of software updates to fix security holes in computers powered by its Windows operating system, including one flaw that hackers are using to infiltrate PCs equipped with a massive security upgrade the company released just five months ago. The three patches, available at http://windowsupdate.microsoft.com, mend four different software holes. Two of the patches earned a "critical" rating from Microsoft, its most serious. The software giant said attackers could exploit three of the flaws merely by convincing users to visit a malicious Web site or open a specially crafted e-mail. The most severe of the flaws involves a glitch in the way Windows handles requests for "HTML help," a function that uses Microsoft's Internet Explorer Web browser to display instructions for using a variety of computer programs. The help-file flaw is present in nearly all versions of Windows, including computers running Windows XP that also have the Service Pack 2 security upgrade installed. Service Pack 2 was released to the public in August to fix a number of persistent security problems and two switch on key Windows XP security features, such as automatic downloading and installation of patches and a firewall to block unwanted Internet traffic. Stephen Toulouse, Microsoft's security program manager, said the company has seen only a handful of attempts to exploit the help-file security flaw. "Still, any amount of exploitation concerns us, and this update addresses that," he said. Oliver Friedrichs, senior manager of security response for Cupertino, Calif.-based security firm Symantec Corp., said his company has seen at least three different cases where malicious Web sites have used the help- file weakness to install spyware on vulnerable computers. Friedrichs cautioned that the other three security flaws remain serious threats, as computer code demonstrating how attackers could wield at least one of them now is publicly available online. Microsoft also released today a "malicious software removal tool," which scours Windows PCs for some of the more prolific Internet worms, including "Blaster," "Sasser," "Mydoom," "Gaobot" and "Nachi." The tool will be distributed to the more than 112 million Windows users who have opted to accept automatic security updates from Microsoft and will be updated once a month, Toulouse said. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/

News URL

http://www.washingtonpost.com/wp-dyn/articles/A1504-2005Jan11.html