Microsoft plugs 21 software holes

Microsoft has released 12 security bulletins that cover a total of 21 security holes in Windows, Exchange and Office.

Eight of the bulletins cover issues rated 'critical', indicating that an attacker could exploit the flaws to take control of a system without the user's knowledge, but that there are mitigating factors.

Most of the repaired security holes are found in the Internet Explorer browser, which received patches for eight vulnerabilities.

Four of the vulnerabilities could allow attackers to take control of a system through a specially crafted website.

In two cases the application could display a spoofed internet address, which could be exploited by phishing websites to steal confidential information such as user names and passwords for financial websites.

Microsoft's Routing and Remote Access Service is suffering from a flaw that could compromise a system's security.

Attackers could exploit the hole by directly attacking affected systems without users having to visit a specially crafted website or open an email attachment.

But the flawed service is turned off by default, limiting the number of computers that are vulnerable to such an attack.

Microsoft also repaired yet another vulnerability in the way that Windows handles WMF images, as well as the ART image format.

The two vulnerabilities could allow attackers to take control of a system by placing a specially crafted image on a website or sending it as an email attachment.

Microsoft was forced to rush out a patch earlier this year for another WMF flaw after attackers started to successfully exploit an unpatched vulnerability.

The same attack method could be used to exploit a vulnerability in Microsoft's Jscript, a technology similar to JavaScript.

The remaining critical vulnerabilities affect the way that Windows Media Player handles PNG images, which again could allow attackers to take control of a system.

Microsoft finally plugged two critical security holes in Word and PowerPoint. Attackers in both cases could use a specially crafted document to take control of a user's system.

Users can download and install the updates through Windows Update or Microsoft Update services.

Additional details on the critical security bulletins, as well as the three updates rated 'important' and the one 'moderate', are available from the Microsoft TechNet website.

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!