News

Microsoft Releases 12 Security Bulletins, 8 Critical

• By Scott Bekker
• 02/08/2005

In all, Microsoft put out 12 security bulletins, one less than the company warned subscribers about last week in its Microsoft Security Bulletin Advanced Notification. Those bulletins covered 17 security vulnerabilities. Ten of the security vulnerabilities covered in eight of the bulletins are critical flaws, according to Microsoft's rating system.

Many of the flaws involved various flavors of the Windows operating system, with nine different bulletins addressing problems with Windows. Other Microsoft bulletins addressed problems in Office, Internet Explorer, .NET, Windows Media Player, Windows Messenger, MSN Messenger, Project and Visio.

Flaws in the public domain usually cause the most concern. Most vulnerabilities are secret until Microsoft patches them, giving attackers and users the same starting line in the race on the one hand to exploit the flaws and on the other hand to patch the vulnerabilities.

One of the critical public flaws patched Tuesday affects Windows and could allow remote code execution from a flaw in an ActiveX control. The bulletin, MS05-013, is critical for Windows 2000, Windows 98, Windows 98 Second Edition and Windows ME. It is classified important for Windows XP with Service Pack 2 and moderate for Windows Server 2003.

The other critical public flaw involves a vulnerability in PNG processing that could allow an attacker to take complete control of a user's system over the Internet. It is addressed in bulletin MS05-009, which covers Windows Messenger, MSN Messenger and Windows Media Player.

The bulletin that includes the most patches is MS05-014, a cumulative update for Internet Explorer. The cumulative update includes patches for two critical vulnerabilities, an important vulnerability and a moderate flaw.

To view Microsoft's summary of the month's patches, click here.