Microsoft warns on IE9 and Windows Server flaws

hacker attack in crossword

Microsoft late yesterday released summaries of 13 bulletins it said would address security flaws across a number of systems as part of its monthly patching cycle.

While nine of the bulletins in the advanced notification

were rated "important" in terms of their threat level and two were rated as "moderate," Microsoft reserved its highest,"critical" threat level for two flaws it said could be used to compromise its browser and server products.

Wolfgang Kandek, chief technology officer at security software firm Qualys, advised enterprises running the affected Windows systems to issue the patches as soon as they become available next Tuesday.

The first critical bulletin affects Internet Explorer(IE) versions 6 to 9 running on Windows 7, Vista, XP, 2008 and 2003 operating systems (OSs). The Microsoft notice said the IE vulnerability it could enable remote code execution for attackers to take control of these systems.

The second critical bulletin the Microsoft is prepping a patch for affects Windows Server OSs. Kandek said: "Server administrators should apply patches immediately as this vulnerability also leads to remote code execution."

The remaining 11 bulletins deal with otherremote code execution vulnerabilities, as well as those that enable elevation of administrative privileges, denial-of-service attacks, and threats to information disclosure.

Of these, Kandek highlighted another remote code execution flaw rated important, affecting Windows 7 and Windows 2008 OSs. As this third bulletin only affects Microsoft's latest OSs, he said it could be could be a little difficult to exploit in comparison to the other two critical flaws.

While also rated important, the remaining remote code execution vulnerability addressed in bulletin four is in Microsoft Office product,Visio.

Kandek advised that his firm had seen other Visio vulnerabilities fairly recently. He recommended: "Include the software in your regular patching cycle and/or have users not using that software remove it from their systems," he said.

This August Patch Tuesday almost halves the number of flaws administrators will have to deal with compared to last month.

Miya Knights

A 25-year veteran enterprise technology expert, Miya Knights applies her deep understanding of technology gained through her journalism career to both her role as a consultant and as director at Retail Technology Magazine, which she helped shape over the past 17 years. Miya was educated at Oxford University, earning a master’s degree in English.

Her role as a journalist has seen her write for many of the leading technology publishers in the UK such as ITPro, TechWeekEurope, CIO UK, Computer Weekly, and also a number of national newspapers including The Times, Independent, and Financial Times.