Microsoft to fix Windows Help Centre flaw, four others

By

Microsoft on Tuesday expects to close two zero-day vulnerabilities.

Microsoft on Tuesday plans to patch a "critical" Windows Help and Support Center vulnerability that is being widely exploited, the software giant announced Thursday.

In addition, Microsoft plans to release three other patches: one impacting Windows and two affecting Office, Jerry Bryant, group manager of response communications at the company, said Thursday in a blog post. In total, five vulnerabilities are expected to be addressed in the monthly security update.

Microsoft to fix Windows Help Centre flaw, four others

Chief among them is the Windows Help Center flaw, affecting XP and Server 2003 machines, which was disclosed last month in a controversial fashion by researcher Tavis Ormandy. Microsoft engineers began spotting in-the-wild exploits targeting the flaw on June 15, five days after the software giant confirmed the bug with the release of a security advisory.

Ormandy's disclosure prompted a number of other proof-of-concepts, followed by active exploits that initially were "targeted and fairly limited" in nature, Microsoft malware specialists said. However, recently the scope of the attacks dramatically widened.

On Tuesday, Microsoft also plans to fix another zero-day Windows vulnerability, disclosed in May. The flaw affects the Canonical Display Driver, which is used by the Windows desktop composition feature to blend drawings created in Graphics Device Interface and DirectX. However, Microsoft security experts have said creating a reliable exploit would be difficult.

This month's update marks the last time customers will receive support for Windows 2000 and Windows XP Service Pack 2 platforms.


See original article on scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Log In

  |  Forgot your password?