September 09, 2008, 3:17 PM — Microsoft has released four sets of security updates for its products, fixing critical flaws in the Windows desktop.
The software maker's monthly set of security updates, released Tuesday, mostly fixes problems in the underlying operating system, but also includes a patch for a component of the OneNote note-taking software that is used by Microsoft Office.
In all, eight bugs are squashed in the four sets of patches, but the most critical problem is addressed in the MS08-052 update, according to Andrew Storms, director of security operations with security vendor nCircle. This update fixes five bugs in the Graphics Device Interface+ (GDI+) software used by Windows programs to draw images on computer screens and printers.
GDI+ was first released as part of the Windows XP operating system, and this latest security fix gets top priority because it is so widely used, security experts say. "If you are running XP, 2003 or 2008, you are going to need an update," Storms said via instant message.
Five months ago, hackers targeted a flaw in the older version of GDI, used by Windows 2000 systems. In these attacks, criminals placed maliciously crafted images on Web sites, which were designed to exploit the GDI flaw and install unauthorized software on the victim's machine.
Although Microsoft has not heard of anyone taking advantage of these latest GDI+ bugs in an attack, now that the software patches are available, hackers can probably reverse-engineer one of the flaws and develop new code that exploits the bugs, Storms said.
In its other Windows updates, Microsoft fixed vulnerabilities in the Windows Media Encoder 9, which is not included in the default Windows configuration, and Windows Media Player 11. Media Player 11 is the latest version of the audio and video player that ships with Windows. The Windows Media Encoder 9 is downloaded as part of the beta code for the Advanced Windows Media Plug-In for Adobe Premier 6.5, Microsoft said.
Although several of September's bugs look like they could be used to create some nasty attacks, they primarily affect Windows desktops rather than servers, said Eric Schultze, chief technology officer at Shavlik Technologies. "So your servers sitting in the data center, you're way less at risk with those," he said. "Worry most abut the computers where people are sitting in front of the keyboard."
