Microsoft deploys January security patches

Three fixes for Microsoft products in January after four bulletins are pulled at the last minute.

Microsoft has delivered its first batch of monthly security bulletins of the year. The latest 'Patch Tuesday' has seen the release of three fixes flagged as 'Critical'.

Two of the three Critical patches affect Office, relating to corrupted data records, and the third is for Windows, affecting Internet Explorer. They could all allow the remote execution of arbitrary code.

Bulletin MS07-002 (http://go.microsoft.com/fwlink/?LinkId=76262) resolves vulnerabilities in Excel, relating to malformed IMDATA records, that could allow remote code execution if an attacker can successfully corrupt system memory. Similarly, Bulletin MS07-003 (http://go.microsoft.com/fwlink/?LinkId=75735) patches Outlook. Specifically, Outlook doesn't perform sufficient data validation when processing the contents of an .iCal meeting request. Again, a specially malformed request may corrupt system memory in such a way that an attacker could execute arbitrary code.

All the major flavours of Office are affected, and both these vulnerabilities require that a user is logged on with admin rights.

Security Bulletin MS07-001 also prevents remote code execution for Office systems, but is only rated as Important because user interaction is required for an attacker to exploit the vulnerabilities. More relevantly, the vulnerability only exists in the Office 2003 Brazilian Portuguese Grammar Checker.

The final critical (http://www.microsoft.com/technet/security/bulletin/rating.mspx) patch, Bulletin MS07-004 (http://go.microsoft.com/fwlink/?LinkId=75735), plugs a vulnerability in Internet Explorer (IE7, IE6 and all the way back to IE 5 SP4). Specifically, there has been a buffer overrun vulnerability in its Vector Markup Language (VML) implementation (for user who were logged on with admin rights). A remote attacker could exploit this via specially crafted Web pages or HTML e-mail.

You can find the full details of the January update on the Microsoft TechNet website.

Note, however, that on Monday Microsoft pulled four patches ahead of the 'Patch Tuesday' posting. Blaming 'unique challenges' for the delay, three of the pulled bulletins - rated as Important - covered vulnerabilities in Windows, Office and Visual Studio, each carrying a maximum severity rating of 'Important'. A fourth bulletin for Windows was marked as Critical.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Citrix mulling potential sale after tumultuous 2021
mergers and acquisitions

Citrix mulling potential sale after tumultuous 2021

15 Sep 2021
Zoom: From pandemic upstart to hybrid work giant
video conferencing

Zoom: From pandemic upstart to hybrid work giant

14 Sep 2021