Microsoft Patch Will Still Leave Issues Unaddressed

Microsoft is kicking off 2011 with a small Patch Tuesday release that will feature fixes for three vulnerabilities in Windows.

The bugs will be patched via two security bulletins, one of which is rated “critical” and affects all supported versions of Windows. The second bulletin, rated “important,” only impacts Windows Vista.

Graphics Bug Not In The Frame

Not included among the Patch Tuesday fixes for the month is a patch for the Windows Graphics Rendering Engine the company recently warned about. According to Microsoft, the Graphics Rendering Engine bug can potentially be used by an attacker to run arbitrary code. The bug was first revealed at a security conference in December, and exploit code has recently been added to the Metasploit Framework.

Also missing is a fix for an Internet Explorer vulnerability Microsoft issued an advisory about in December that exists due to the creation of uninitialized memory during a Cascading Style Sheets (CSS) function within IE. Under certain conditions, it is possible for an attacker to leverage the memory to execute code remotely. According to Microsoft, the issue impacts IE 6, 7 and 8.

“This month we will not be releasing updates to address Security Advisory 2490606 (public vulnerability affecting Windows Graphics Rendering Engine) and Security Advisory 2488013 (public vulnerability affecting Internet Explorer),” blogged Carlene Chmaj, senior response communications manager for Microsoft Trustworthy Computing.

“We continue to actively monitor both vulnerabilities and for Advisory 2488013 we have started to see targeted attacks,” Chmaj continued. “If customers have not already, we recommend they consult the Advisory for the mitigation recommendations. We continue to watch the threat landscape very closely and if the situation changes, we will post updates here on the MSRC blog.”

Also unaddressed is the Internet Explorer vulnerability uncovered by Google security engineer Michal Zalewski that was publicised earlier this week, as well as vulnerabilities impacting the Microsoft Windows Management Instrumentation Administrative Tools WMI Object Viewer ActiveX Control security researchers warned about last month.

The Patch Tuesday updates are slated to be released on January 11.