Microsoft says Internet Explorer versions 6 through 10 are subjects of two critical Patch Tuesday updates for February that could address recent Java woes.
Both critical patches address vulnerabilities that could give attackers access to client browsers and from there access to the underlying host, says Alex Horan a senior product manager at CORE Security. "Bulletins 1 and 2 target all versions of Internet Explorer on essentially all versions of Windows platforms, so it's pretty much one-hack fits all in the Windows environment for attackers," he says. "I expect a lot of interest in developing a working exploit for this vulnerability."
[NEWS: Microsoft launches campaign against Gmail over privacy
HELP: 11 (FREE!) Microsoft tools to make life easier
NAVIGATE: 12 essential Windows 8 keyboard shortcuts]
Three less urgent patches ranked important could address flaws that enable the takeover of machines accessed via the Internet Explorer vulnerabilities, he says. "Bulletins 7, 8 and 9 seem to target the same underlying systems as Bulletins 1 and 2, which means hackers could phish users and then leverage 7, 8 and 9 to get system level control of their machines. That is essentially a worst case scenario and knockout punch for security personnel," Horan says.
Another security expert Paul Henry, a security and forensic analyst for Lumension, says the two critical Internet Explorer problems could be linked to Java. "It's possible that this is related to the recent and ongoing Java issues," he says. "Microsoft has a very close relationship with Oracle, so it wouldn't surprise me if these bulletins include Java patches."
Regardless, they put unpatched machines in danger of falling to remote code execution exploits, Microsoft says, and may require restarting affected machines, something that will make installing the patches a longer exercise.
There are 12 patches in all this month, an uptick from the past few months, and they affect a wide range of Windows platforms from Windows XP to Windows RT, the new Windows 8 tablet operating system that runs on ARM processors. "It's never a good sign when your current code base is impacted," Henry says. This month's 12 patches is the highest number since June 2011 when there were 16.
One remaining patch ranked important affects the FAST indexing server for SharePoint and is caused by an update to some Oracle libraries used for document conversion by Microsoft, says
The remaining bulletins are all rated important and are mostly "Local Elevation of Privilege" type of vulnerabilities, meaning that one already has to be on the targeted computer to be able to attack them. One exception is Bulletin 5, which can be used for Remote Code Execution. It affects the FAST Indexing server for SharePoint and it is also caused by Oracle's update of the Outside In libraries that are used by Microsoft for document conversion processes, says Wolfgang Kandek, CTO for Qualys.
Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter https://twitter.com/#!/Tim_Greene.)
Read more about wide area network in Network World's Wide Area Network section.