Microsoft moves to patch remote access bugs in IE, Edge and Windows

Datacentre admins get a break as patches target desktop flaws

Microsoft has rolled out nine security updates, some of which fix vulnerabilities allowing a hacker to take over your PC.

Part of its monthly Patch Tuesday cycle, the nine updates address flaws present in Windows Vista onwards, Office, Internet Explorer and Edge.

Five of the updates have been flagged as critical, fixing Remote Code Execution vulnerabilities that could allow a hacker to take over a victim's PC. Some of these flaws can be found in Internet Explorer (MS16-095) and Microsoft Edge (MS16-096). Hackers could take over a machine simply by making their victim visit a malicious website.

Advertisement - Article continues below

Vulnerabilities in Microsoft Office (MS16-099) could also allow remote code execution if a user opens a specially crafted Microsoft Office file. "An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user," said Microsoft in an advisory.

MS16-097 is a critical security update for the Microsoft Graphics component, and it fixes flaws in many Microsoft software solutions, including Windows, Office, Skype for Business, and Microsoft Lync.

"The vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document," said the firm in another advisory.

Advertisement - Article continues below

There is also a vulnerability in the Windows PDF Library.

"This bug has the same sort of risk profile as MS16-099: if a potential new customer sends a request for a quote in a PDF file, you're on the horns of a dilemma," said Paul Ducklin, senior technologist at Sophos. "Do you reject it because this is your first email from them? (If so, you aren't likely to grow your business much.) Or do you open it because PDFs are widely used, and a perfectly normal part of business correspondence these days? (If so, you're accepting a small but definite risk.)"

Advertisement - Article continues below

Amol Sarwate, Qualys director of vulnerability, said in a blog post that top priority goes to patching Microsoft Office and browsers. "MS 16-099 covers issues that allow attackers to take complete control of a victim's machine remotely," he said.

"It is not too difficult to social engineer an email attachment which is targeted for users in your organisation to exploit this issue," he added.

Rapid7's security research manager, Tod Beardsley, added that this month's patches appear to concentrate on the desktop.

"It looks like IT administrators who are responsible for the datacentre machines get a break," he said.

"This is not to say the server operating systems are completely unaffected, of course. For example, Windows servers running Terminal Services tend to act as both desktop and server environments."

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


operating systems

How to factory reset Windows 10

4 Mar 2020
Microsoft Windows

Windows 10 needs to go back to basics

13 Jul 2020
Microsoft Windows

Virtualise Windows 7 under Windows 10

5 Jul 2020

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020

Most Popular

Careers & training

IBM job ad calls for 12-years of experience with six-year-old Kubernetes

13 Jul 2020
Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020
cyber attacks

Trump confirms US cyber attack on Russia election trolls

13 Jul 2020