Microsoft Releases Cumulative Security Update for IE

Microsoft Corp. Tuesday released a cumulative security upgrade that fixes newly discovered vulnerabilities in its Internet Explorer browser — including one critical flaw for which exploit code is already available.

The company also issued a bulletin addressing a privilege escalation vulnerability in the Windows kernel that could allow hackers to take control of an affected system. Microsoft classified that vulnerability as important.

Microsoft’s cumulative security upgrade described in bulletin MS05-054 details patches for four vulnerabilities in Internet Explorer and replaces an earlier cumulative update issued by the company in October.

Both bulletins were included as part of Microsoft’s monthly security update program. The patches released Tuesday are the last of the company’s scheduled updates for the year.

These are the four browser flaws that have been fixed:

— A critical remote code vulnerability in the way IE creates certain COM objects such as ActiveX Controls

— A critical vulnerability in the way Internet Explorer handles mismatched Document Object Model objects that allows attackers to take full control of compromised systems

— A remote code flaw in the way Internet Explorer displays file download dialog boxes and accepts user input that could allow hackers to execute code remotely on affected systems

— An information disclosure vulnerability in the way Internet Explorer behaves in situations requiring client systems to authenticate themselves.

Of those, the mismatched Document Object Model flaw is especially important to patch because an exploit for it is already available, said Neel Mehta, team lead at Atlanta-based Internet Security Systems Inc.’s X-Force security research team.

The flaw was originally disclosed as a denial-of-service vulnerability by Microsoft several months ago but was upgraded to a critical issue by Microsoft because of the availability of exploit code for it, he said.

“We’ve seen isolated exploitation of this issue in the wild,” Mehta said. “People need to realize the exploit code works very well,” and they should patch their systems as soon as possible, he said.

The availability of the exploit last month had some security analysts predicting that Microsoft would release an out-of-cyle patch.

“I feel they held off giving us an emergency patch because they knew they were releasing a cumulative IE update anyway,” said Russ Cooper, editor of the NTBugtraq mailing list and a senior scientist at Cybertrust Inc. in Herndon, Va.

By waiting, the company missed an opportunity to show that its out-of-cycle release methods are still working well, Cooper said. “That said, it is understandable, I believe, to the security community that the active threat was not prevelant enough to warrant the emergency push.”

By Jaikumar Vijayan – Computerworld (US online)