Microsoft announced 12 bulletins for February’s Patch Tuesday. Three of the bulletins are critical and include updates to address recently disclosed flaws in Internet Explorer and Windows.
p
Beyond the three critical bulletins, nine are rated important, addressing issues in Microsoft Windows, Internet Explorer, Microsoft Office, Visual Studio, and IIS.
p
February’s Patch Tuesday release comes after only two security bulletins addressing three vulnerabilities were issued in January. But January’s light Patch Tuesday skipped some known vulnerabilities, including the recursive style-sheet load bug in IE.
p
subhead
Info for Techies
/subhead
p
These vulnerabilities have seen limited exploits in the wild, so applying the update is highly recommended, said Wolfgang Kandek, CTO at Qualys. In addition, the lower-rated flaw in the FTP service is addressed with an update to the IIS server.
p
The remaining updates address flaws in Windows, Office and the development platform Visual Studio. Kandek said all versions of Windows, starting with Windows XP SP3 up to the latest versions of Windows 7 and Windows Server 2008 R2, are affected. The Office bulletin, however is limited to a relatively small footprint: The Visio versions 2002, 2003 and 2007.
p
The recent MHTML issue in Windows and Internet Explorer will not be addressed in this update, Kandek said. The work-around suggested by Microsoft in Advisory 2501696 continues to be the recommended way of mitigating this attack vector.
p
The vulnerability exists due to the way MHTML interprets MIME-formatted requests for content blocks within a document. Microsoft said it’s possible under certain conditions for this vulnerability to allow an attacker to inject a client-side script in the response of a web request run in the context of Internet Explorer.
p
subhead
Microsoft Shows Some Love
/subhead
p
Technical details aside, Paul Henry, forensic and security analyst at Lumension, said it looks like IT admins might be finally getting a patch for Internet Explorer this month. That means 900…