Internet Explorer Flaw Finally Fixed in June Patch Tuesday
It's almost that time of the month — time for Patch Tuesday! It's that special day when Microsoft releases its latest upgrades and security fixes. This Patch Tuesday, June 10, Microsoft is expected to release a patch for an Internet Explorer 8 bug it allegedly knew about six months ago.
A total of seven security bulletins were included in Microsoft's customary pre-Patch Tuesday alert, two of which have been given a "critical" severity rating, the highest possible.
MORE: Best Antivirus Software 2014
Microsoft designates as critical flaws those that allow remote code execution without the knowledge of the legitimate user. In such a scenario, an external attacker could seize control of a targeted computer and (usually) gets all the same system permissions as did the hapless user who was logged in when the attack began.
The first critical bulletin concerns the now-infamous Internet Explorer 8 bug, disclosed a few weeks ago by Hewlett-Packard's Zero Day Initiative (ZDI), a "bug bounty" program that rewards experts who discover and disclose security vulnerabilities. Allegedly, ZDI contacted Microsoft back in October about a serious flaw in IE 8 (and only IE 8; other versions of Microsoft's browser appear unaffected by this particular flaw).
ZDI says Microsoft never responded, so according to ZDI's policy of publicly disclosing bugs within 180 days of discovery, program administrators disclosed the issue in late May.
IE 8 is the last version of Internet Explorer that is compatible with Windows XP, which Microsoft stopped supporting in April. Did Microsoft retire XP knowing that a serious vulnerability remained on one of XP's main programs?
In response to ZDI's disclosure, Microsoft responded that it would patch this IE 8 flaw, but didn't specify when. Microsoft security manager Dustin Childs confirmed in a blog post that Bulletin One is about that fix; it deals with remote code execution on all supported versions of Internet Explorer (6 through 11) on all supported versions of desktop Windows (Vista, 7, 8 and 8.1, and RT and RT 8.1) and Windows Server (2003, 2008, 2008 R2, 2012, 2012 R2 and Server Core).
Bulletin Two deals with a critical flaw in Microsoft Windows, Office and Lync (an Office-bundled instant-messaging client). It affects all supported versions of Windows Server as well as Microsoft Office 2007 Service Pack 3, Office 2010 Service pack 1 and 2, Microsoft Live Meetings 2007, Microsoft Lync 2010 and Lync 2013.
The other five bulletins are all rated "Important," the second-highest severity rating. Bulletin 3 appears to be the most serious, as it also involves remote code execution, but it only affects Microsoft Word 2007 Service Pack 3 and Office Compatibility Pack Service Pack 3.
We won't know until Tuesday afternoon exactly what's going on with this flaw, but in the past, remote-code-execution flaws have been deemed "Important" rather than "Critical" if user action is necessary for a successful exploit.
Bulletins 4 and 5 deal with information disclosure, or when software doesn't adequately protect data that passes through it, leading to "leakage" of information. The first concerns the most recent updates of older software — desktop Windows Vista Service Pack 2 and Windows 7 Service Pack 1, and Windows Server 2003 Server Pack 2, 2008 Service Pack 2 and 2008 R2 Service Pack 1 — as well as the current desktop Windows 8 and 8.1, tablet RT and RT 8.1, and Windows Server 2012. Bulletin 5 affects Lync Server 2010 and Lync Server 2013.
Bulletin 6 deals with a denial-of-service flaw on desktop Vista Service Pack 2, Windows 7 Service Pack 1, Windows 8 and Windows 8.1, tablet RT and RT 8.1, and Windows Server 2008 Service Pack 2, 2008 R2 Service Pack 1, 2012 and 2012 R2.
And finally, Bulletin 7 has to do with a tampering flaw on Microsoft Windows 7, Server 2008 R2, 8, 8.1, Server 2012 and 2012 R2.
We'll post on Patch Tuesday when the updates themselves come out, along with more detailed explanations of the issues they address.
Email jscharr@tomsguide.com or follow her @JillScharr and Google+. Follow us@TomsGuide, on Facebook and on Google+.
Copyright 2014 Toms Guides , a TechMediaNetwork company. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
