Microsoft
has released 13 updates that patch security holes in a wide range of
its software offerings, including vulnerabilities rated critical in its Internet Explorer browser and Windows server operating systems.
The bugs in IE
make it possible for attackers to remotely execute malicious code when
an end user does nothing more than visit a booby-trapped website.
Although there's no evidence the vulnerabilities are being exploited in
the wild now, members of Microsoft's security team said there was a high
likelihood reliable exploit code would be developed by real-world
attackers in the next 30 days.
The vulnerabilities affect all supported versions of the Microsoft
browser, including versions 8 and 9, which were rebuilt from scratch to
minimize the damage that can be done when hackers identify
vulnerabilities.
The second critical update covers all versions of Windows Server 2003
and Windows Server 2008, including the most recent R2 iteration, which
is regarded as one of Microsoft's most secure server operations systems
ever. By setting up a malicious DNS server and getting a vulnerable
system to query it from inside the victim's network, an attacker can
take complete control of the underlying machine.
According to Microsoft's exploitability index for August, attackers aren't likely to exploit the DNS flaw in the next month.
The remaining 11 patches carry the lower-level ratings of important and
moderate and affected products including Windows, Office, .Net, and
Visual Studio. Vulnerable components include the Remote Desktop Web
Access Login, Microsoft Chart Web Control, and the Report Viewer Web
control. The vulnerabilities enable attacks involving information theft
and and denial of service outages.
Roundups of this month's Patch Tuesday offerings from Microsoft and SANS are here and here. Commentary from Kaspersky Lab and Qualys is here and here.