Windows
Windows

Doubts raised over Microsoft patches

Danish firm finds flaws in security fixes

Written by Iain Thomson

Security patches released by Microsoft last week may not completely protect users, according to a Danish security consultancy.

Microsoft security alert 65 and alert 66 deal with the Windows operating system and Internet Explorer, and are rated 'critical' and 'important' respectively.

Advertisement

Alert 66, a bundled software patch for Internet Explorer versions five and six, is aimed at fixing six specific faults in the browser.

Simon Conant, of Microsoft product support services, said: "If users update with this patch they will be covered for all the currently known security flaws.

"They'll still need to use patch 65 as well as that's not a specific Internet Explorer patch but can affect the software."

But Danish security company Secunia said it has identified flaws with both patches.

Microsoft has admitted patch 65 may not be fully effective in certain circumstances, but it has made no mention of problems with patch 66.

Although patch 65 does offer a broad solution it is still vulnerable to malicious websites and HTML emails. If the browser downloads ActiveX controls automatically it might be possible to reintroduce malicious code.

The software giant has suggested that users remove its software from the Trusted Publisher list and check the software's origin before downloading.

Part of the flaw in patch 66 means it is still possible for a website to run an executable that is stored on a system.

This could allow an outsider to view the contents of a previously identified file and view the clipboard.

Secunia spotted the flaws while installing and checking the patches. Details of how to fix them can be found here.

"I was very shocked at the problems, particularly with alert 65," said Thomas Kristensen, chief technical officer of Secunia.

"We noticed the problems and only then did we find them mentioned in the FAQ. The only way around them is to manually install all digital certificates after checking their veracity, and who wants to do that?" he said.

Microsoft could not provide a comment on Secunia's discoveries by the time of going to press.

Tags:

Related whitepapers

Related jobs

Do you agree?

IT white papers

Search vnunet IThound

Top categories

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Watch

Shaun Nichols and Iain Thomson

03 Oct 2008

6.49 MBPodcast Special: Views from the Valley More...

Podcast image

02 Oct 2008

14.35 MBComputing podcast - Next-generation broadband Britain; and we report from Gartner's IT security summit More...

Shaun Nichols and Iain Thomson

26 Sep 2008

3.43 MBPodcast Special: Views from the Valley More...

Poll

Google Android

Google Android

Are you intending to try out a Google Android mobile phone?

Previous poll results

Spotlight

MoD building

Latest data breach leads MPs to demand culture change

MoD admits to losing a hard drive containing up to...  More...

Online shopping

E-retailers urged to prepare for Christmas

Credit crunch sending shoppers online for cheaper presents   More...

Mobile phone

Emerging markets drive mobile growth

Mobile penetration rates expected to reach 95 per cent by...  More...

Digital information

Poor data classification costing companies dear

Millions wasted on searching through clutter, says analyst   More...

Primary Navigation