Microsoft has released the second instalment of its monthly security bulletins, patching three software holes in Windows systems which, it claimed, were "critical" security risks and a fourth problem with Microsoft Office rated "important".
Together the security holes could allow attackers to set up web pages to take advantage of vulnerable systems and read files or run attack code on a remote user's Windows machine, Microsoft said.
Bulletin MS03-049, affects Windows 2000 and Windows XP workstations and fixes a critical buffer overrun vulnerability in a Windows service called the Workstation Service, which manages requests for files or printing services on a local area network.
That service is turned "on" by default in Windows and could be compromised by an attacker using an improperly formatted network message that was sent to a vulnerable machine. ( www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/winnov03.asp)
The second bulletin, MS03-051, patches two critical problems that were discovered in Microsoft's FrontPage Server Extensions, which are installed by default with the Internet Information Services (IIS) on certain versions of Windows 2000 and allows technical staff to create, manage and add features to web pages.
Microsoft said that it fixed a buffer overrun in the FrontPage Server Extensions that could enable an attacker to place and run attack code on a vulnerable machine, as well as a flaw in the way that a component called SmartHTML interpreter works that made it vulnerable to denial-of-service attacks.
The company also issued a cumulative security patch, MS03-048, for the Internet Explorer (IE) web browser.
The patch updates previous cumulative patches for IE and sews up five vulnerabilities in the product, including a problem with the browser's cross-domain security model, which governs how different websites share information and interact with the Windows operating system.
The fourth patch, MS03-050, fixes a security hole in some versions of Microsoft's Excel spreadsheet and Word word-processing products that could enable an attacker to embed an attack in a small program, known as a macro.
Machines running vulnerable versions of those products could have malicious code placed and run on their Windows system after opening an infected spreadsheet or Word document. ( www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/offnov03.asp)
Microsoft only last month switched to a system of releasing monthly security bulletins, replacing a system of weekly security updates.
The company made the change in response to complaints from Microsoft customers about the difficulty of staying on top of the weekly releases.
Paul Roberts writes for IDG News Service