Critical Patch Tuesday flaw easy to exploit

Microsoft only released three new security bulletins for Patch Tuesday, but one vulnerability has security experts concerned.

Guess what today is? Yes, it is Fat Tuesday--the official kick off of Mardi Gras. But, it's also Patch Tuesday. Again. The good news is that there are only three security bulletins--only one of which is rated Critical. The bad news is that the Critical flaw will be very easy for attackers to exploit.

The main concern this month is MS11-015, which addresses two separate vulnerabilities. The security bulletin explains that the more severe vulnerability could be exploited to allow an attacker to execute malicious code remotely. The good news is that triggering the vulnerability requires some action on the part of the user. But, social engineering attacks related to video clips are common, and often relatively successful.

"The lone critical issue this month - the DVR-MS vulnerability - will be somewhat trivial for attackers to exploit," said Joshua Talbot, security intelligence manager, Symantec Security Response. "It also allows attackers to skip a few of the traditional steps needed to get malicious code to execute on a targeted computer. This is because when processing DVR-MS files, Windows Media Player and Media Center use data in these files themselves to determine what code in memory gets executed. This allows an attacker to jump directly to executing malicious code."

As for the other two March security bulletins, there isn't much to see. Tyler Reguly, technical manager of security research and development for nCircle, says, "DLL Preloading is such a snooze it's really not worth talking about anymore."

Notably absent from the Patch Tuesday lineup is a fix for the MHTML flaw discovered in late January. It was expected that it wouldn't make the cut for last month's Patch Tuesday updates because of the short notice. But, with over a month to analyze the bug and develop a patch, it was expected that Microsoft would resolve the problem this time around.

Andrew Storms, director of security operations for nCircle, points out that April could bring another avalanche of patches and updates. "CanSec West's Pwn2own hacking contest is also scheduled for later this week and that traditionally unearths some interesting Internet Explorer and Windows 7 phone security bugs."

As always--whether Microsoft releases two security bulletins, or twelve--Microsoft and security experts all recommend that any applicable patches and updates be applied as soon as possible. Attacks against zero-day vulnerabilities grab headlines, but frequently malware targets known vulnerabilities that vendors have already deployed patches for, but customers haven't applied the updates.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags spamantispamsymantecMicrosoftvirusessecuritypatches & driversphishingmalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?