Patch Tuesday: Critical security holes in Microsoft Office

Patch Tuesday: Critical security holes in Microsoft Office

Summary: Microsoft has shipped a patch for to fix several critical security holes affecting its Office productivity suite and warned that hackers can use RTF (Rich Text Format) e-mails to launch code execution attacks.

SHARE:

Microsoft has shipped a patch for to fix several critical security holes affecting its Office productivity suite and warned that hackers can use RTF (Rich Text Format) e-mails to launch code execution attacks.

The MS10-087 bulletin, which is considered a high-priority update,  patches a total of 5 documented vulnerabilities affecting all currently supported Microsoft Office products.

It is rated critical for Office 2007 and Office 2010 because of a preview pane vector in Microsoft Outlook that could trigger the vulnerability when a customer views a specially crafted malicious RTF file, the company explained.

Details emerge on new DLL load hijacking Windows attack vector]

follow Ryan Naraine on twitter

The update also patches the DLL load hijacking attack vector that haunted multiple Windows applications, including Microsoft' own Office software.

Microsoft urges Office users to consider this a "top priority bulletin" and warned that reliable exploit code is likely within the next 30 days.

As part of the November Patch Tuesday release, the company also patched a pair of security flaws in Microsoft PowerPoint and four documented flaws in Unified Access Gateway (UAG), which is a component of Microsoft Forefront.

HD Moore: Critical bug in 40 different Windows apps ]

More information on those bulletins:
  • MS10-088 This bulletin resolves two cooperatively disclosed vulnerabilities in Microsoft PowerPoint that could allow remote code execution if a user opens a specially crafted PowerPoint file. The overall severity rating is Important due to the user interaction required to open the malicious file and we give the bulletin a rating of 2 in our deployment priority assessment.

  • MS10-089 This bulletin resolves four cooperatively disclosed vulnerabilities in Unified Access Gateway (UAG), which is a component of Microsoft Forefront. The most significant of these could allow elevation of privilege if a user clicks on a malicious link on a website. This update is offered through the Microsoft Download Center and is not available through Microsoft Update at this time. With an overall severity rating of Important and user interaction required to exploit, we also give this a deployment priority of 2.

ALSO READ:

Topics: Security, Collaboration, Microsoft, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

11 comments
Log in or register to join the discussion
  • OMG

    nt
    Dietrich T. Schmitz, ~ Your Linux Advocate
    • Some would want us to just sweep this under the rug. Keep it quit.

      Who would click a exile file off the Internet, someone that has been doing this sort of thing for awhile. A soccer fan in Salto Uruguary, wanting to get there local soccer schedule.

      Yes I know no software is a 100% perfect, but maybe get to at least 99%
      daikon
  • Outlook Preview Pane

    I always shut that down - first setting to customize Outlook. Why is it the default to enable it? It's always been a source of vulnerabilities. Why is that even though it's disabled, creating a new folder will enable it for that folder? For the record, I do not enable preview panes in any other mail clients either. At least let me decide on the message before the app tries to render the thing...
    jacarter3
  • Shocking

    A Microsoft product with holes so big you could drive a Mack truck through....

    Count me shocked.
    itguy08
    • RE: Patch Tuesday: Critical security holes in Microsoft Office

      @itguy08

      - A Microsoft product with holes so big you could drive a Mac throught...

      Nice...

      /F
      Sceptics anonymous
    • RE: Patch Tuesday: Critical security holes in Microsoft Office

      The same could be said about the empty space inside your skull. :)
      The one and only, Cylon Centurion
      • RE: Patch Tuesday: Critical security holes in Microsoft Office

        @Cylon Centurion 0005
        So you are not shocked that there is A Microsoft product with holes so big you could drive a Mac through ?
        thedavidmckenzie
      • RE: Patch Tuesday: Critical security holes in Microsoft Office

        It's software. Software has holes. Fact of life.

        ITGuy08 makes it seem as if Microsoft is the only one to deal with this.
        The one and only, Cylon Centurion
    • What makes a hole big enough to drive a Mack truck through?

      @itguy08: [i]A Microsoft product with holes so big you could drive a Mack truck through....[/i]

      I'm curious as to how these holes are larger than any other holes found in other software. Details please.
      ye
  • sssssssssssssssaasdasdfgffsd

    fffffffffffffffffffffssdwasdasdww
    mirxing
  • RE: Patch Tuesday: Critical security holes in Microsoft Office

    No, I don't believe it!
    james347