Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Microsoft fixes IE memory problems

Joab Jackson | Feb. 11, 2015
Windows and Office also got patches this month as part of Microsoft's scheduled update.

Internet Explorer is getting major repairs, as Microsoft has issued 41 patches to fix memory vulnerabilities in its browser.

The Internet Explorer patches are part of the company's routine monthly release of security and bug fixes for its software products, called "Patch Tuesday." Microsoft Office and both the desktop and server editions of Windows are also getting fixes in this batch.

Overall, Microsoft issued patches to cover 56 different vulnerabilities, which are bundled into nine separate security bulletins.

Three of the bulletins are marked as critical, meaning they fix vulnerabilities that could be exploited by malicious attackers without user intervention. System administrators should tend to critical vulnerabilities as quickly as possible. These bulletins cover Internet Explorer and both the server and desktop editions of Windows.

All three collections of critical patches will require a reboot of the machine to take effect.

The patches in the Internet Explorer critical bulletin, which affects all versions of the browser, address the way the browser handles objects in memory. Microsoft has addressed the issue of memory vulnerabilities in its ASLR (address space layout randomization) technology. The patches add permissions validations to ensure Internet Explorer uses ASLR correctly.

Of the 41 Internet Explorer vulnerabilities, only one has been publicly disclosed, but it can only be used in conjunction with other vulnerabilities.

This approach is not unusual, said Wolfgang Kandek, chief technology officer for the Qualys IT security firm. These days, many attackers deploy "blended attacks" that use multiple vulnerabilities in conjunction with one another to compromise a system.

The remaining six bulletins are marked as important, which means they address vulnerabilities that could be exploited by attackers usually by requiring the unwitting participation of the user, such as by tricking him or her into clicking on a specially crafted Web page.

Organizations using Microsoft Office should inspect the bulletins issued this month that touch upon that software, Kandek said. One vulnerability, covered in MS15-012, allows an attacker to gain control of a system merely by tricking the user into opening a document, such as an email, with malicious code embedded inside.

One of the more unusual patches, MS15-011, covers a vulnerability in Windows group policy, which is configuration management technology that Kandek has never seen Microsoft patch before. It only affects larger enterprises that use domain controllers to manage fleets of Windows machines.

In the wrong hands, this vulnerability could be used to take control of large numbers of Windows machines within an organization, Kandek said. MS15-011 shows that Microsoft is digging deeper into its own code base to look for potential security weaknesses.

The group policy patch is not available for Windows 2003, which Microsoft will stop supporting in July.


1  2  Next Page 

Sign up for CIO Asia eNewsletters.