Microsoft issued a series of security updates yesterday - one correcting previous mistakes, another featuring better support of affected software, all containing patches and some deemed critical.
The first bulletin in the roundup is a revision of a previous one issued on 31 July and concerns Microsoft Data Access Components 2.5, 2.6 and 2.7 MS02-040, specifically the Open Database Connectivity (ODBC) component. The situation is further complicated by the company`s statement that the revision is superseded by another bulletin, MS03-033.
Microsoft explains: "Subsequent to the release of [the first] bulletin, it was determined that the vulnerability addressed is not with the OpenRowSet command - which is a Microsoft SQL Server command - but rather with ODBC, which is present in all versions of Windows [but not vulnerable in Windows Server 2003].
"Additionally, the original patch released with this did not install correctly on some systems because of a flaw in the way that Microsoft Windows Installer updated the System File Protection cache. The bulletin has been updated to include this additional information and to direct users to an updated patch."
Microsoft says "the patch for this security bulletin has been superseded by the patch in MS03-033. Customers who are seeking the patch for MS02-040 should instead install the patch for MS03-033."
The vulnerability in question exists because one of the ODBC functions in MDAC, used to connect to data sources, contains an unchecked buffer. An attacker could seek to exploit this with a Web page, which, when visited by the user, could execute code of the attacker`s choice with the user`s privileges. The Web page could be hosted on a Web site or sent to the user in an e-mail.
The maximum risk of this vulnerability is considered critical. However, the superseding advisory calls it "important".
IE vulnerabilities
Microsoft Internet Explorer 5.01, 5.5, 6.0 and 6.0 for Windows Server 2003 are patched up by Bulletin MS03-032, reported widely on international sites.
Considered critical, the vulnerabilities in IE are given a cumulative patch by Microsoft, including the functionality of all previously released patches for the abovementioned versions of IE, and in addition eliminates newly discovered vulnerabilities.
Windows multimedia support is next in the vendor`s updates. An unchecked buffer in DirectX, also considered critical, could likewise allow an attacker to execute code on a user`s system and is a revision of a previous advisory. Security Bulletin MS03-030 now supports additional versions of DirectX not covered by original patches.
DirectX consists of a set of low-level application programming interfaces (APIs) used by Windows programs for multimedia support. Within DirectX, the DirectShow technology performs client-side audio and video sourcing, manipulation and rendering. There are two buffer overruns with identical effects in the function used by DirectShow to check parameters in a MIDI file.
"A security vulnerability results because it is possible for a malicious user to exploit these flaws and execute code in the security context of the logged-on user," the company states.
Share
