Microsoft addresses 34 vulnerabilities in new patch
-
06/09/2010
Microsoft released a new patch on Tuesday to address 10 security gaps that could enable an attacker to take control of a Windows computer by using malicious content through Internet Explorer.
In total, the Washington-based company issued 10 bulletins, fixing 34 vulnerabilities affecting versions of many of its products, including Windows, Microsoft Office and internet Explorer, CNET reports.
Joshua Talbot, security intelligence manager at Symantec Security Response said that the patch was the largest Microsoft "release of 2010 and ties the record for the most vulnerabilities ever addressed in a single month," which was set in October of last year, CNET relays.
Microsoft places special empahsis on three critical bulletins - MS10-033, MS10-034 and MS10-035.
The first bulletin fixes a hole in Quartz.dll and Asycfult.dll, which if left unaddressed could trigger a vulnerability when a user visits particular websites or opens malicious files.
The second update applies Kill Bits for Internet Explorer 8 Developer Tools control and Data Analyzer ActiveX control as well as four third-party controls.
The final critical bulletin provides an all-encompassing update for Internet Explorer. The company said that only one vulnerability, of the six mentioned in the bulletin, is associated with an information disclosure vulnerability.
Microsoft also released a patch to fix the Pwn2Own vulnerability that netted security researcher Peter Vreugdenhil $10,000 in the Pwn2Own contest at the CanSecWest security conference in Vancouver, The Register relays. Vreugdenhil bypassed security measures, such as DEP and ASLR, to take complete control of a Windows 7 machine.
|