Microsoft closes 26 holes for August Patchday

For its August Patch Tuesday, Microsoft has released nine security bulletins that close twenty-six security holes in its products. Five bulletins fix critical flaws that allowed attackers to remotely execute code on the affected system. These flaws affect Windows, Internet Explorer, Office, Visual FoxPro, Visual Basic, and Exchange Server, as well as additional server variants. Some of these products are also affected by bugs that Microsoft has rated as important.

In particular, users of Windows XP are advised to update their systems as quickly as possible. A vulnerability in XP's remote desktop protocol (RDP) can be exploited by sending malformed RDP packets to gain complete access to the affected system. This problem only affects systems that have the remote desktop service enabled. Unlike the RDP hole that Microsoft closed in March, only Windows XP is affected this time.

Another bulletin addresses several holes in the Remote Administration Protocol and one in the Windows print spooler, which can lead to remote code execution on Server 2003 and Windows XP systems. On all other versions of Windows, the vulnerability can be exploited to cause a denial-of-service (DoS) condition – which most often means making the system crash.

Microsoft has also fixed a critical bug in the MSCOMCTL.OCX system library which could be exploited through a specially prepared web site or email to deliver malicious code to the system. According to Microsoft, this vulnerability is already being actively exploited. The MSCOMCTL.OCX library is used by Microsoft Office, SQL Server, Commerce Server, Host Integration Server, Visual FoxPro and the Visual Basic 6.0 runtime.

Additionally, the company has closed critical holes in Exchange Server 2007 and 2010 which were caused by Oracle's Outside In file parsing libraries. The fifth critical bulletin closes a collection of holes in Internet Explorer 6 through 9, including an integer overflow in the JavaScript engine used by these versions.

A bulletin that was originally released in July and closed a critical hole in Microsoft's XML Core Services had to be reworked and re-released by the company. In the original version of the document, versions 3.0, 4.0 and 6.0 of Core Services were marked as affected, but the company had neglected the problem in Core Services 5.0 – the updated bulletin now affects that version as well. It's not clear how widespread use of Core Services 5.0 actually is, but an exploit for the vulnerability has been circulating in the wild for two months now.

(fab)