Microsoft Issues Warning On Security Glitch In Older Windows Releases

The Windows Graphics Rendering Engine in Windows Vista, Windows Server 2003 and Windows XP has a security vulnerability and the company is developing an update to address the problem, Microsoft (NSDQ:MSFT) said Tuesday.

Microsoft issued a security advisory that said an attacker could use the vulnerability for remote code execution and install programs; view, change or delete data; or create new accounts with full user rights.

Microsoft said it is not aware of any attacks relating to the vulnerability. The advisory provides mitigations and workarounds for the problem.

In addition to developing a “comprehensive security update” to address the problem, Microsoft said it’s “monitoring the threat landscape and working with partners through the Microsoft Active Protections Program to take action against malicious sites that may attempt to exploit this vulnerability.”

via Microsoft Issues Warning On Security Glitch In Older Windows Releases.

Microsoft issues warning over wave of Java attacks | TG Daily

Holly Stewart says that while working on the company’s Security Intelligence Report she noticed an unprecedented amount of Java exploitation late last year.

“In fact, by the beginning of this year, the number of Java exploits (and by that I mean attacks on vulnerable Java code, not attacks using JavaScript) had well surpassed the total number of Adobe-related exploits we monitored,” she says.

The spike, she says was caused by attacks on three volnerabilities – all of which are already patched. The problem, says Stewart, is that users simply aren’t updating their machines.

“Java is ubiquitous, and, as was once true with browsers and document readers like Adobe Acrobat, people don’t think to update it,” she says.

via Microsoft issues warning over wave of Java attacks | TG Daily.

Microsoft issues ‘critical’ patch for shortcut bug | BBC News

Microsoft has issued a “critical” security update to fix a flaw in the way Windows handles shortcuts.

The bug allowed attackers to craft booby-trapped shortcuts that allow them to take over a target computer.

Many users set up shortcuts to get to programs and places in Windows that they use regularly.

Microsoft said it released the patch because it had seen an increase in the number of attacks on the vulnerability.

The fix will be sent out to those that automatically update their machines. It will also be available via the Windows Update site.

via BBC News – Microsoft issues ‘critical’ patch for shortcut bug.

Microsoft issues emergency Google attack patch | Reuters

Microsoft Corp on Thursday released a patch to protect users of its Internet Explorer browser from attacks similar to those directed at Google Inc’s operations in China last week.

The world’s largest software company, which said hackers targeting Google and at least 20 other companies in China exploited a weakness in its browser, said its new patch was “critical” and people should apply it as soon as possible.

Other hackers have begun to exploit the flaw, according to researchers with Symantec Corp, the world's biggest security software maker.

Symantec has found viruses that take advantage of the weakness in Microsoft’s browser on some 100 websites, security researcher John Harrison said on Thursday.

They are dangerous because they can infect the PC of any user who visits those sites. Unlike less powerful viruses, it is not necessary for people to download software for their machines to become infected, Harrison said.

PCs are safe if they apply the patch, which resolves eight vulnerabilities in Internet Explorer, Microsoft said. The most serious could allow hackers to gain control of a computer remotely via Web sites people visit while using the browser.

via Microsoft issues emergency Google attack patch | Reuters.