IE zero-day bug fixed in Patch Tuesday updates

Posted by   Virus Bulletin on   Dec 9, 2009

Serious browser bug main feature of monthly alerts, Adobe Flash issue also patched.

Microsoft has released the December Patch Tuesday security bulletin, with a total of six alerts. The most significant issue covered is a serious vulnerability in the Internet Explorer browser software.

Three of the six bulletins were marked as 'Critical', with vulnerabilities in Microsoft Project and Internet Authentication Services fixed alongside the now customary cumulative patch covering a selection of problems recently spotted with IE. All could lead to remote execution of code.

Less serious, but still labelled 'Important', were fixes for the Local Security Authority Subsystem Service (LSASS), Active Directory and text conversion features in WordPad and Office applications.

Once again Adobe has followed Micorosoft's lead by releasing its own set of updates on the same date - a serious flaw in the Flash player software, again described as 'critical', has been patched, and further alerts have been issued about Illustrator products.

The official Microsoft bulletins are available here, with a summary from SANS here and some commentary in The Register here. Adobe's alerts are here. As always, VB advises readers to ensure all systems are fully patched and up-to-date as soon as possible.

Posted on 09 December 2009 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

NCSC gives important advice on lateral movement

The UK's National Cyber Security Centre (NCSC) has provided helpful and practical advice on preventing and detecting lateral movement by an attacker within a network.

What kind of people attend Virus Bulletin conferences?

If you are considering submitting a proposal for a talk to VB2018 and you're not familiar with the event, you may find it useful to know what kind of people attend the conference.

Olympic Games target of malware, again

An unattributed malware attack has disrupted some computer systems of the 2018 Winter Olympics. In 1994, a computer virus also targeted the Winter Olympics.

There are lessons to be learned from government websites serving cryptocurrency miners

Thousands of websites, including many sites of government organisations in the UK, the US and Sweden, were recently found to have been serving a cryptocurrency miner. More interesting than the incident itself, though, are the lessons that can be…

We need to continue the debate on the ethics and perils of publishing security research

An article by security researcher Collin Anderson reopens the debate on whether publishing threat analyses is always in the public interest.