Tech Shout!

Microsoft as usual has released its regularly scheduled batch of security patches. This time the patches are meant for fixing flaws in Windows and the Microsoft Content Management Server. It was only last week that Microsoft had to issue an emergency Windows patch soon after attackers began exploiting a bug in the Windows .ANI animated cursor files.

Totally, Microsoft has fixed seven flaws, today, five of which are critical and are in Windows. In addition to the Content Management Server update, Microsoft also fixes critical flaws in the Windows Client Server Run-Time Subsystem, Microsoft Agent and Plug and Play services.

According to Vince Hwang, group product manager at Symantec’s Security Response division, a client remote code execution vulnerability in Microsoft Agent that affects its processing of specially rigged URLs is the most serious of all the flaws.

The vulnerability which affects the Microsoft Agent ActiveX component of Microsoft Windows 2000, Windows XP and Windows Server 2003, could well enable an attacker to gain complete control over a victim’s PC, which usually results in theft of confidential data and loading of malicious software for subsequent attacks.

System administrators should pay particular attention to the Windows Client Server Run-Time Subsystem (MS07-021) and Plug and Play (MS07-019) updates, said Amol Sarwate, manager of Qualys’ vulnerability research lab.

The MS07-021 update fixes an unpatched Windows vulnerability that was first reported late last year, Sarwate said. Although attack code that leverages this flaw has not been widely used, it could let a criminal run unauthorized software on a victim’s computer, he said. For this to happen, however, a victim would first need to be tricked into visiting a malicious Web site.

This bug did not gain as much attention as the .ani cursor flaw because it was not publicly known that it could be exploited to run software on a victim’s computer.

Microsoft made that discovery during the course of its investigation, said Christopher Budd, a security program manager with Microsoft. “What we found out was what was publicly being called an elevation of privilege issue, was actually more complex and did have the possibility of code execution,” he said. “This is an instance where the thoroughness of our internal investigation turned up elements that were never uncovered in the public discussion.”

All three of the bugs patched in MS07-021 apply to Windows Vista but the other three Windows updates do not, Budd said.

The Plug and Play flaw could be exploited with no user action whatsoever, Sarwate added, but attacks that would take advantage of this flaw can be blocked at the firewall, he said.