Microsoft patches Windows Vista, IE 7

Microsoft released six security bulletins to fix 15 flaws across its product line, including Windows XP, Vista and Internet Explorer 7. Attackers could exploit the most serious flaws remotely to run malicious code on victims' machines.

Patch management experts said IT administrators should put top priority on deploying the patches for Internet Explorer and Windows, particularly those included in MS07-031, 032 and 033.

Don Leatham, director of solutions and strategy for PatchLink, said he's most concerned about the Internet Explorer flaws outlined in MS07-033.

"Internet Explorer is the most widely used application out there and there's a lot of exploit potential in these flaws," he said.

Microsoft updates: Microsoft offers details on MOICE advisory, Outlook flaws: Microsoft's Christopher Budd outlines the finer points behind this month's security bulletins and gives an update on the new bulletin layout.

Leatham noted that some flaws affect the latest version, Internet Explorer 7, and show that Microsoft continues to struggle to "get its IE code under control."

Eric Schultze, chief security architect at Shavlik Technologies LLC, said he considers the worst flaws to be those in MS07-031 and 032.

"With the MS07-031 issue, if someone visits an evil site with SSL, that secure connection can actually be used to hijack the box," he said. "Windows XP users are in the most danger here. With MS07-032, we're looking at a Vista flaw Microsoft calls moderate. But they may be going fast and loose in explaining the seriousness of it."

He said the Vista flaw could be especially problematic for IT shops that have upgraded from XP to Vista, and that if a Vista box is compromised, the hacker could obtain the user name and password.

Here is a summary of all the June 2007 Microsoft security updates, in chronological order:

MS07-030 is an "important" update fixing a remote code execution flaw that appears when users open a specially crafted Visio file.

MS07-031 is a "critical" update fixing a flaw in the Secure Channel (Schannel) program in Windows. Microsoft noted that the Schannel security package implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Internet standard authentication protocols and that attackers could exploit the flaw for remote code execution if a user views a specially crafted Web page or application that uses SSL/TLS.

"Attempts to exploit this vulnerability would most likely result in the Web browser or application exiting," Microsoft said. "The system would not be able to connect to Web sites or resources using SSL or TLS until a restart of the system." The glitch affects Windows 2000, XP and Windows Server 2003.

MS07-032 is a "moderate" bulletin fixing a flaw attackers could exploit in Windows Vista to access local user data, including administrative passwords contained within the registry and local file system.

MS07-033 is a "critical" update fixing five privately reported vulnerabilities and one publicly disclosed vulnerability. Attackers could exploit all but one to remotely run malicious code on targeted machines if the user views a specially crafted Web page using Internet Explorer. The flaw affects Internet Explorer 5.01 and 6, as well as most supported releases of Internet Explorer 7.

MS07-034 is a "critical" update fixing two privately reported and two publicly disclosed vulnerabilities. Attackers could exploit one flaw to run malicious code on targeted machines if the user views a specially crafted email using the Windows Mail program in Windows Vista. Attackers could exploit the other flaws to access sensitive information if the user visits a specially crafted Web page using Internet Explorer.

MS07-035 is a "critical" update fixing a Win32 API flaw. Attackers could run malicious code on targeted machines and get extra user privileges if the affected API is used locally by a specially crafted application. "Therefore, applications that use this component of the Win32 API could be used as a vector for this vulnerability," Microsoft said. "For example, Internet Explorer uses this Win32 API function when parsing specially crafted Web pages." Microsoft said the problem affects all supported versions of Windows 2000, XP, and Windows Server 2003.

Security firm McAfee said in a statement that the majority of flaws addressed this month could be exploited through malicious Web sites.

"Today's Microsoft patches underline the risk of surfing the Web unprotected," Dave Marcus, security research and communications manager at McAfee Avert Labs, said in the statement. "Many of the vulnerabilities addressed by the fixes could be exploited if a Windows user simply visits a malicious Web site, a favourite attack method among cyber criminals."