New Security Patches from Microsoft

Today Microsoft Corp. released its February set of security updates, including critical fixes for bugs in Office and the scanning engine used by the company's security products.

In total, 6 of Microsoft's 12 updates are rated as "critical," the other 6 have the less-serious rating of "important." Among the patches is a widely anticipated update for Microsoft Word, which fixes 6 bugs in Microsoft's word processing software. Hackers had been exploiting a number of these bugs in very targeted attacks over the past few months. The updates fix 20 bugs in total, including all 4 of the Word flaws that hackers had been exploiting. Other critical patches fix bugs in the ActiveX HTML Help control and Microsoft Data Access Components, both used by Windows, as well as flaws in Office (including Excel, PowerPoint) and Internet Explorer. Versions of these programs used on Windows 2000 and XP could have these loopholes.

The security software flaw is of particular concern because it could, in theory, be very easily exploited by an attacker to run unauthorized software on a victim's PC. "An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file," Microsoft said in its bulletin on the patch. Symantec rated this scanning engine flaw the most critical of the vulnerabilities patched on Tuesday.

Customers can download all the patches for free on Microsoft's security Web site www.microsoft.com/security and also can sign up to have them automatically delivered to their computers.