March 09, 2010, 9:41 PM — Microsoft fixed eight flaws in Windows and Office today, but passed on patching one Windows component because it cannot be automatically updated.
The eight bugs patched today were far from the near-record 26 that Microsoft fixed last month when it delivered 13 security updates. Both of today's bulletins were ranked "important," the second-highest rating in Microsoft's four-step severity scoring system, even though the company acknowledged that the eight vulnerabilities could be used to completely compromise a Windows PC.
Although security experts recommended that users deploy the Office fix first, several argued today that the Windows update was more interesting because Microsoft declined to patch one of the two pieces of involved software.
MS10-016 fixes a single flaw in Windows Movie Maker, a consumer-grade video editor bundled with Windows Vista, and available as a separate download for users of Windows XP and Windows 7 . Hackers could exploit the bug and hijack the PC by duping users into opening a malicious Movie Maker project file, which uses the ".mswmm" file extension.
While Microsoft patched Movie Maker, it passed over Producer 2003, a downloadable add-on for PowerPoint 2002 and PowerPoint 2003 that allows those presentation makers to play .mswmm files.
Jerry Bryant, a senior manager for the Microsoft Security Response Center (MSRC), and the group's usual spokesman, explained why the company didn't patch Producer 2003. "Our standard approach is to produce updates that can be deployed automatically for all affected products at the same time, but Producer 2003 does not offer a means for automatic update," he said in an entry on the MSRC blog today.
Security researchers took stabs at why Microsoft didn't patch Producer 2003.
"Someone made a strategic decision," said Andrew Storms, director of security operations at nCircle Network Security. "Maybe because not enough people use the product to warrant a full release cycle."