Microsoft’s Patch Tuesday Fixes Windows, Office

Microsoft’s Patch Tuesday is a relatively minor one, with a single bulletin rated “critical” and two “important”. Affected software includes applications within Windows and Office.

The MS11-015 update, rated “Critical”, patches vulnerabilities in DirectShow, Windows Media Player and Windows Media Centre. In order for an outside entity to exploit said vulnerabilities, the user would need to open a specially crafted Microsoft Digital Video Recording (DVR-MS) file.

DVR-MS issue

“The lone critical issue this month – the DVR-MS vulnerability – will be somewhat trivial for attackers to exploit,” Joshua Talbot, security intelligence manager for Symantec Security Response, wrote in an 8 March email. “It also allows attackers to skip a few of the traditional steps needed to get malicious code to execute on a targeted computer. This is because when processing DVR-MS files, Windows Media Player and Media Centre use data in these files themselves to determine what code in memory gets executed.”

The next “Important” update, MS11-017, patches a vulnerability in Windows Remote Desktop Client that could allow remote code execution if a user opens a Remote Desktop configuration file (.rdp) located in the same network folder as a “specially crafted library file,” according to Microsoft. “For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application.”

The third update, MS11-016, is rated “Important” and aims to resolve a vulnerability with Microsoft Groove. Similar to the vulnerability patched by MS11-017, this one could allow an outside entity to remotely execute code if a user opens a legitimate file in the same network directory as a specially crafted library file.

DLL problems

“The other vulnerabilities fixed this month all relate to the DLL issues Microsoft has been working to address for some time now,” Talbot added in his note. “These are fairly easy to exploit, but because an attack would require to take some fairly uncommon steps – such as opening up malicious files from SMB or WebDAV servers – they’re less likely to pose a serious threat.”

This current Patch Tuesday update follows a far larger one in February, which saw fixes for 22 vulnerabilities across a number of Microsoft software platforms, including Windows, Internet Explorer, Microsoft Office and IIS. That followed a relatively sedate January, which included only two security bulletins.