Microsoft issues two patches for March

gallery

Microsoft has issued two patches to fix eight flaws in its Windows operating system and Office.

Microsoft advised administrators to deploy the pair of critical updates as soon as possible.

The MS10-016 patch fixes an issue in the version of Windows Movie Maker that shipped in XP and Vista, as well as the version that can be downloaded to Windows 7.

"In order to take advantage of the vulnerability, a user would need to open a specially crafted Movie Maker project file," security communications lead Jerry Bryant said in a blog post.

The MS10-016 flaw also hits Microsoft Producer 2003, but Microsoft is offering no fix. "Our standard approach is to produce updates that can be deployed automatically for all affected products at the same time but Producer 2003 does not offer a means for automatic update," Bryant said.

"Based on our investigation, we determined that the best way to protect the vast majority of customers was to release an update addressing the components that shipped with Windows."

Microsoft advised users to uninstall producer 2003 or us the Microsoft Fix It to add an "extra layer of security."

The second patch, MS10-017, is for all versions of Excel. "As with most Office vulnerabilities, a user would have to open a specially crafted file in order to be exploited," Bryant said.

Symantec said the types of flaws are less of a problem with Windows 7.

“Since Windows 7, Microsoft has seemed to downgrade file-based vulnerabilities,” said Joshua Talbot, security intelligence manager, Symantec Security Response, in a statement. “In the past, I think many of the vulnerabilities patched this month could have been rated critical, but with protections like DEP and ASLR, these types of vulnerabilities are less of an issue for Windows 7."

"My concern is that in many enterprise environments, Windows XP is still common, and these vulnerabilities are more serious on XP and older systems,” he added.

Microsoft still hasn't patched a VBScript flaw, saying it hasn't yet seen any attacks. "Customers that are running Windows 7, Windows Server 2008, Windows Server 2008 R2, and Windows Vista are not affected."

More details on the patches are available from Microsoft here.

Email to a friend

Print this page