Microsoft's patch package includes critical Word fix
Contributed by: Email on 12/11/2012 11:19 AM
[
Comments
]
Today's package of patches from Microsoft includes a rare critical patch for Microsoft Word. Traditionally, Microsoft rates Word vulnerabilities as important as users are usually expected to open a file manually, so whatever the vulnerability, manual intervention is required. In the case of MS12-079 though, all the user needs to do is preview a specially crafted RTF email in Outlook for whatever malware resides within to be run with the same privileges as the logged in user. It is possible to configure Outlook not to preview email as RTF, but as plain text. This does reduce functionality though and it will be easier to install the patch.
All versions of Windows, from XP SP3 to Windows 8 and Windows RT are affected by MS12-078. This critical hole involves a vulnerability in kernel mode drivers which can be exposed by displaying a document or web page with embedded specially crafted TrueType or OpenType fonts which can lead to remote code execution. Only Server 2008 has a lower rating where the flaw is reduced to an elevation of privilege.
Nearly all versions of Windows, from XP SP3 to Windows 7 and Windows Server 2008 are affected by MS12-081; Windows 8, RT and Server 2012 are the only ones unaffected. The hole allows remote code execution with the user's privileges if they browse a directory with a specially crafted Unicode file name. For users of Internet Explorer 9 and 10, MS12-077 is essential as it closes critical remote code execution flaws in the browsers on most Windows versions. The patch also applies to IE 6, 7 and 8 but only as a "defense in depth" measure, according to Microsoft.
The Oracle Outside In file conversion libraries flaws from earlier in the year are still showing up in applications that use them. In this case, MS12-080 takes on a critical remote code execution issue with Outlook Web Access and Exchange 2007 SP3 and 2010 SP1 and 2, which stems from the use of Outside In; exploitation could allow an attacker to run code on the server, albeit with a limited privilege account. Microsoft had addressed other Outside In holes with Exchange in August.
Two important patches are also included. MS12-082 is for a remote code execution vulnerability in DirectPlay in combination with Office documents with embedded media, and MS12-083 patches a hole where revoked certificates to HTTPS server can bypass security features.
All versions of Windows, from XP SP3 to Windows 8 and Windows RT are affected by MS12-078. This critical hole involves a vulnerability in kernel mode drivers which can be exposed by displaying a document or web page with embedded specially crafted TrueType or OpenType fonts which can lead to remote code execution. Only Server 2008 has a lower rating where the flaw is reduced to an elevation of privilege.
Nearly all versions of Windows, from XP SP3 to Windows 7 and Windows Server 2008 are affected by MS12-081; Windows 8, RT and Server 2012 are the only ones unaffected. The hole allows remote code execution with the user's privileges if they browse a directory with a specially crafted Unicode file name. For users of Internet Explorer 9 and 10, MS12-077 is essential as it closes critical remote code execution flaws in the browsers on most Windows versions. The patch also applies to IE 6, 7 and 8 but only as a "defense in depth" measure, according to Microsoft.
The Oracle Outside In file conversion libraries flaws from earlier in the year are still showing up in applications that use them. In this case, MS12-080 takes on a critical remote code execution issue with Outlook Web Access and Exchange 2007 SP3 and 2010 SP1 and 2, which stems from the use of Outside In; exploitation could allow an attacker to run code on the server, albeit with a limited privilege account. Microsoft had addressed other Outside In holes with Exchange in August.
Two important patches are also included. MS12-082 is for a remote code execution vulnerability in DirectPlay in combination with Office documents with embedded media, and MS12-083 patches a hole where revoked certificates to HTTPS server can bypass security features.
Comments
