Microsoft Patch Day Lacks an IE Fix

Microsoft has released a fix for a critical hole in the HTML Help ActiveX control in Windows, but a well-known vulnerability in the Internet Explorer browser remains unpatched.

Just days after a researchers raised the threat level because an IE exploit was making the rounds, Microsoft rolled out a patch that lessens the danger. But officials admit that a comprehensive browser fix is not yet ready.

“We’re still working on the IE update,” said Stephen Toulouse, program manager at the Microsoft Security Response Center. “As soon as we’re satisfied with the quality of the patch, we’ll release it.”

In the absence of a browser fix, Microsoft released MS05-001 to plug a “critical” code execution flaw in the HTML Help ActiveX control. The advisory warned that a successful exploit could allow an attacker to “take complete control of an affected system” to load, manipulate or delete data.

“This helps mitigate against some of those threats and discussions we’ve seen during the last week,” Toulouse said. “This patch specifically prevents the HTML Help Control from being used by remote Web sites out of the Internet zone.”

According to Toulouse, the exploits circulating are taking advantage of both flaws. “With the HTML Help patch, it reduces the criticality until we can get the IE fix finished and ready. Instead of being at risk by just visiting a Web page, the user would not have to take action on the page,” he said.

The HTML Help flaw is rated critical in Windows 2000, Windows XP Service (including Service Pack 2), Windows 98 and Windows NT. In Windows Server 2003, the severity rating is moderate.

A second bulletin, MS05-002, includes a fix for a remote code execution vulnerability in Cursor and Icon Format Handling.

The image handling flaw, first flagged by Symantec Corp. over the Christmas holidays, could allow an attacker to construct a malicious cursor or icon file that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message.

“An attacker who successfully exploited this vulnerability could take complete control of an affected system,” Microsoft said.

The advisory also patches a bug in the Windows Kernel that could allow denial-of-service attacks.

The first batch of Microsoft patches for 2005 also corrected a flaw in the Windows Indexing Service that could lead to code execution attacks. The patch, MS05-003, carries an “important” rating and affects Windows 2000, Windows XP (SP1 only) and Windows Server 2003.

As expected, Microsoft also released a malicious software removal tool to zap 10 of the most well-known viruses and worms. The worm zapper, available for download here, has been programmed to detect and delete the Blaster, Sasser, MyDoom, DoomJuice, Zindos, Berweb/Download.Ject, Gailbot and Nachi viruses.

The virus removal tool will be updated once a month as part of the company’s security patching cycle.

Check out eWEEK.com’s for Microsoft and Windows news, views and analysis.