Microsoft patches four critical IE, Exchange holes
Microsoft on Tuesday released security updates that fix four critical vulnerabilities in Internet Explorer and Exchange Server that could allow an attacker to take control of an affected computer remotely.
Microsoft Security Bulletin MS09-002 plugs two critical holes in IE that could allow remote code execution if an IE user views a Web page that has malicious code, according to Microsoft's notification.
"Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights," the bulletin said.
Security Bulletin MS09-003 fixes two critical vulnerabilities in Exchange Server. One could allow for remote code execution if a maliciously crafted TNEF (Transport Neutral Encapsulation Format) message is sent to an Exchange Server and could allow an attacker to take complete control of the system with Exchange Server service account privileges. The second hole could allow for a denial of service attack if a maliciously crafted MAPI (Messaging Application Programming Interface) command is sent to an Exchange Server.
Security Bulletin MS09-004 fixes an important remote code execution vulnerability in SQL Server that could be exploited if untrusted users access an affected system or if a SQL injection attack occurs. The vulnerability was discovered in December.
And Security Bulletin MS09-005 closes three important vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a maliciously crafted Visio file. An attacker could then steal data and make changes to accounts with full user rights.
The updates affect Internet Explorer 7, Windows XP Professional Edition, Windows Vista, Exchange 2000 Server, Exchange Server 2003 and 2007, SQL Server 2000 and 2005 and Office Visio 2002, 2003 and 2007.
Andrew Storms, director of security operations for security firm nCircle, predicted that while there were no known exploits for the Exchange vulnerability, attackers were likely working on them.
"All kinds of highly confidential and proprietary information pass through an Exchange server every day," he said in a statement. "Gaining control over it and its content would be a goldmine to any cybercriminal."
Meanwhile, the IE update is less critical because it requires action on the part of the user, Storms added.
As it always does, Microsoft had provided advance notification last week that it would have four security updates on Patch Tuesday.
Updated 12:30 p.m. PST with nCircle comment.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Did you have anything useful to contribute to the conversation or did you only mean to embarass yourself?
- by JohnTate2 February 12, 2009 12:00 PM PST
- Let me add a technical comment. Happy to leave other posts to fight over Microsoft v Apple etc.The latest batch of patches has updated over 200 DLL's. We have a product called AOK that reports on and fixes application compatibility issues. Using this in our lab with 800 apps we found over 90% have DLLS that were affected by this. The most significant patch update for some time! This suggests a real risk that some apps will stop working. More info at http://www.changebase.com/news/news_release_2009_02_10.html
- Like this Reply to this comment
-
(6 Comments)Off the technical front - I am based in London. It is snowing and wet. England lost to Spain at football last night and our economy is up the shoot. My cat is overweight and I have just finished working a 15 hour day. So if Applerocks thinks things are tough .....