Microsoft releases January security update

Microsoft has delivered its batch of security bulletins for January. The latest ‘Patch Tuesday’ has seen the release of three fixes flagged as ‘Critical’.

Two of the three Critical patches affect Office, relating to corrupted data records, and the third is for Windows, affecting Internet Explorer. They could all allow the remote execution of arbitrary code.

Bulletin MS07-002 resolves vulnerabilities in Excel, relating to malformed IMDATA records, that could allow remote code execution if an attacker can successfully corrupt system memory. Similarly, Bulletin MS07-003 patches Outlook. Specifically, Outlook doesn’t perform sufficient data validation when processing the contents of an .iCal meeting request. Again, a specially malformed request may corrupt system memory in such a way that an attacker could execute arbitrary code.

All the major flavours of Office are affected, and both these vulnerabilities require that a user is logged on with admin rights.

Security Bulletin MS07-001 also prevents remote code execution for Office systems, but is only rated as Important because user interaction is required for an attacker to exploit the vulnerabilities. More relevantly, the vulnerability only exists in the Office 2003 Brazilian Portuguese Grammar Checker.

The final Critical, Bulletin MS07-004, plugs a vulnerability in Internet Explorer (IE7, IE6 and all the way back to IE 5 SP4). Specifically, there has been a buffer overrun vulnerability in its Vector Markup Language (VML) implementation (for user who were logged on with admin rights). A remote attacker could exploit this via specially crafted Web pages or HTML e-mail.

You can find the full details of the January update on the Microsoft TechNet website.

Note, however, that on Monday Microsoft pulled four patches ahead of the ‘Patch Tuesday’ posting. Blaming ‘unique challenges’ for the delay, three of the pulled bulletins – rated as Important – covered vulnerabilities in Windows, Office and Visual Studio, each carrying a maximum severity rating of ‘Important’. A fourth bulletin for Windows was marked as Critical.