Microsoft moves to patch remote access bugs in IE, Edge and Windows

Datacentre admins get a break as patches target desktop flaws

Microsoft has rolled out nine security updates, some of which fix vulnerabilities allowing a hacker to take over your PC.

Part of its monthly Patch Tuesday cycle, the nine updates address flaws present in Windows Vista onwards, Office, Internet Explorer and Edge.

Five of the updates have been flagged as critical, fixing Remote Code Execution vulnerabilities that could allow a hacker to take over a victim's PC. Some of these flaws can be found in Internet Explorer (MS16-095) and Microsoft Edge (MS16-096). Hackers could take over a machine simply by making their victim visit a malicious website.

Vulnerabilities in Microsoft Office (MS16-099) could also allow remote code execution if a user opens a specially crafted Microsoft Office file. "An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user," said Microsoft in an advisory.

Advertisement - Article continues below

MS16-097 is a critical security update for the Microsoft Graphics component, and it fixes flaws in many Microsoft software solutions, including Windows, Office, Skype for Business, and Microsoft Lync.

"The vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document," said the firm in another advisory.

There is also a vulnerability in the Windows PDF Library.

"This bug has the same sort of risk profile as MS16-099: if a potential new customer sends a request for a quote in a PDF file, you're on the horns of a dilemma," said Paul Ducklin, senior technologist at Sophos. "Do you reject it because this is your first email from them? (If so, you aren't likely to grow your business much.) Or do you open it because PDFs are widely used, and a perfectly normal part of business correspondence these days? (If so, you're accepting a small but definite risk.)"

Amol Sarwate, Qualys director of vulnerability, said in a blog post that top priority goes to patching Microsoft Office and browsers. "MS 16-099 covers issues that allow attackers to take complete control of a victim's machine remotely," he said.

"It is not too difficult to social engineer an email attachment which is targeted for users in your organisation to exploit this issue," he added.

Rapid7's security research manager, Tod Beardsley, added that this month's patches appear to concentrate on the desktop.

"It looks like IT administrators who are responsible for the datacentre machines get a break," he said.

"This is not to say the server operating systems are completely unaffected, of course. For example, Windows servers running Terminal Services tend to act as both desktop and server environments."

Featured Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now



Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
operating systems

Best Windows 10 apps

10 May 2019

Most Popular

mergers and acquisitions

Xerox threatens hostile takeover after HP rebuffs $30bn takeover

22 Nov 2019

Microsoft issues statement debunking Teams ransomware rumours

21 Nov 2019

Salesforce takes AWS relationship to the next level

19 Nov 2019

Tests show UK's 5G network is 450% faster than 4G

20 Nov 2019