Update: Microsoft patches critical Windows, server flaws

Microsoft has released its regularly scheduled batch of security patches, fixing critical flaws in Windows and the Microsoft Content Management Server.

The updates come one week after Microsoft was forced to rush an emergency Windows patch, when attackers began exploiting a bug in the way Windows processes .ani animated cursor files.

In addition to the Content Management Server update, Microsoft fixed critical flaws in the Windows Client Server Run-Time Subsystem, Microsoft Agent and Plug and Play services.

In total, the new patches fix seven critical flaws, five of which are in Windows. A fifth update fixes a less-critical flaw in the Windows kernel.

All three of the critical Windows patches should be installed as quickly as possible, security vendors said Tuesday. Symantec Corp. rated the Microsoft Agent ( MS07-020) patch the most critical because this service runs on a large number of systems. "A successful exploit could allow an attacker to install malicious code of his/her choice and potentially allow the attacker to gain complete control of the affected system in the worst case scenario," Symantec said in a statement.

System administrators should pay particular attention to the Windows Client Server Run-Time Subsystem ( MS07-021 ) and Plug and Play ( MS07-019 ) updates, said Amol Sarwate, manager of Qualys Inc.s vulnerability research lab.

The MS07-021 update fixes an unpatched Windows vulnerability that was first reported late last year, Sarwate said. Although attack code that leverages this flaw has not been widely used, it could let a criminal run unauthorized software on a victim's computer, he said. For this to happen, however, a victim would first need to be tricked into visiting a malicious Web site.

This bug did not gain as much attention as the .ani cursor flaw because it was not publicly known that it could be exploited to run software on a victim's computer.

Microsoft made that discovery during the course of its investigation, said Christopher Budd, a security program manager with Microsoft. "What we found out was what was publicly being called an elevation of privilege issue, was actually more complex and did have the possibility of code execution," he said. "This is an instance where the thoroughness of our internal investigation turned up elements that were never uncovered in the public discussion."

All three of the bugs patched in MS07-021 apply to Windows Vista but the other three Windows updates do not, Budd said.

The Plug and Play flaw could be exploited with no user action whatsoever, Sarwate added, but attacks that would take advantage of this flaw can be blocked at the firewall, he said.

Users of the Content Management Server should also make the MS07-018 update a priority, he said. However, the newer version of this product, called Office SharePoint server, is not vulnerable to the flaws that are fixed in this patch.

For customers who are having problems with last week's .ani ( MS07-017 ) update, Microsoft re-released a hotfix for that patch, which takes care of problems that the update was causing for users of the ElsterFormular, TUGZip and CD-Tag software. This hotfix had been available for manual download last week, but now it can be downloaded through Microsoft's various automatic update services.