Patch Tuesday's update small, but critical, Microsoft says

Microsoft Tuesday issued two security updates detailing patches for applications in Windows and Office that the company deemed critical

Microsoft Tuesday issued two security updates detailing patches for applications in Windows and Office that the company deemed critical, because one of the vulnerabilities could sneak up on administrators via third-party software installations.

Microsoft goes small for next week's Patch Tuesday

Industry watchers expect to see more patch updates from vendors other than Microsoft in response to Security Bulletin MS10-031. Microsoft categorized this vulnerability as critical for all supported versions of Microsoft Visual Basic for Applications SDK and third-party applications that use Microsoft Visual Basic for Applications. This security update is also rated Important for all supported editions of Microsoft Office XP, Microsoft Office 2003, and the 2007 Microsoft Office System, the company stated in the bulletin.

"The vulnerability could allow remote code execution if a host application opens and passes a specially crafted file to the Visual Basic for Applications runtime. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system," according to Microsoft.

The issue for IT departments regarding this update is that third-party vendors could pass the vulnerability along in their applications. Also this vulnerability doesn't require significant action to be taken by end users to kick off malicious activity, according to Joshua Talbot, security intelligence manager, Symantec Security Response.

"I've put the Visual Basic for Applications vulnerability first on my list," Talbot said, in a statement. "The VBA vulnerability requires less action from a user. For instance, an attacker would simply have to convince a user to open a maliciously crafted file — likely an Office document — which supports VBA and the user's machine would be compromised. I can see this being used in targeted attacks, which are on the rise."

Defined as critical by Microsoft, MS10-030 addresses a privately reported vulnerability in Outlook Express, Windows Mail and Windows Live Mail. The vulnerability could enable remote code execution if an end user visits a malicious e-mail server, according to Microsoft. The security risk addressed with this patch could quickly "crop up" again for IT departments, says Jason Miller, data and security team manager for Shavlik Technologies in Minneapolis.

"With Windows Live Mail, a user could install Windows Messenger, which would ultimately land this on your system," Miller explains. "Usually operating system patches apply to the base default operating systems, but this one has a series of cases in which it is not installed out of the box."

The attack vector for this vulnerability is still less likely to be exploited, according to Wolfgang Kandek, CTO of Qualys.

"Successful exploitation however is unlikely (exploitability index = 2 ) as it requires extensive user involvement including setting up an e-mail account on a malicious server," Kandek wrote in a statement. "We don't see Outlook Express/Windows Mail being used in the enterprise but smaller businesses could be affected."

Do you Tweet? Follow Denise Dubie on Twitter here.

Read more about wide area network in Network World's Wide Area Network section.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags microsoft patchesvisual basicwindows update

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Denise Dubie

Network World
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?