Microsoft Patch Day Lacks an IE FixBy Ryan Naraine | Posted 2005-01-11 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
Microsoft patches a critical hole in the HTML Help ActiveX control in Windows, but a comprehensive fix is not yet ready for a known Internet Explorer exploit.Microsoft has released a fix for a critical hole in the HTML Help ActiveX control in Windows, but a well-known vulnerability in the Internet Explorer browser remains unpatched.
Just days after a researchers raised the threat level because an IE exploit was making the rounds, Microsoft rolled out a patch that lessens the danger. But officials admit that a comprehensive browser fix is not yet ready.
"We're still working on the IE update," said Stephen Toulouse, program manager at the Microsoft Security Response Center. "As soon as we're satisfied with the quality of the patch, we'll release it."
According to Toulouse, the exploits circulating are taking advantage of both flaws. "With the HTML Help patch, it reduces the criticality until we can get the IE fix finished and ready. Instead of being at risk by just visiting a Web page, the user would not have to take action on the page," he said.
The HTML Help flaw is rated critical in Windows 2000, Windows XP Service (including Service Pack 2), Windows 98 and Windows NT. In Windows Server 2003, the severity rating is moderate.
A second bulletin, MS05-002, includes a fix for a remote code execution vulnerability in Cursor and Icon Format Handling.
The image handling flaw, first flagged by Symantec Corp. over the Christmas holidays, could allow an attacker to construct a malicious cursor or icon file that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message.
"An attacker who successfully exploited this vulnerability could take complete control of an affected system," Microsoft said.
The advisory also patches a bug in the Windows Kernel that could allow denial-of-service attacks.
The first batch of Microsoft patches for 2005 also corrected a flaw in the Windows Indexing Service that could lead to code execution attacks. The patch, MS05-003, carries an "important" rating and affects Windows 2000, Windows XP (SP1 only) and Windows Server 2003.
As expected, Microsoft also released a malicious software removal tool to zap 10 of the most well-known viruses and worms. The worm zapper, available for download here, has been programmed to detect and delete the Blaster, Sasser, MyDoom, DoomJuice, Zindos, Berweb/Download.Ject, Gailbot and Nachi viruses.
The virus removal tool will be updated once a month as part of the company's security patching cycle.
Check out eWEEK.com's for Microsoft and Windows news, views and analysis.