Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:35 PM
Connect Directly

Microsoft Warns Of Windows Graphics Vulnerability

Disclosed last month, a flaw in the Windows Graphics Rendering Engine could be used to execute malicious code.

Microsoft on Tuesday issued a security advisory about a publicly reported vulnerability in the Windows Graphics Rendering Engine, warning that the successful exploitation of this vulnerability could allow the execution of arbitrary code under the permissions granted by the victim's account.

The company said that it's not aware of attacks leveraging this vulnerability. Affected systems include Vista, Server 2003, and Windows XP, but not Windows 7 or Windows Server 2008 R2.

SANS Internet Storm center handler and security researcher Johannes Ullrich observes that the vulnerability could be exploited through malicious thumbnail images attached to Office documents and sent via e-mail or over a network. He says there's no patch available but there are steps that can be taken to mitigate the risk by preventing the rendering of thumbnail images.

The vulnerability was disclosed last month by security researchers Moti Joseph and Xu Hao at the Power of Community conference.

Angela Gunn, senior marketing communications manager with Microsoft's Trustworthy Compuing group, says that Microsoft is working to address the vulnerability and that it's not serious enough to warrant an out-of-band patch. Microsoft's next scheduled set of security patches is due Tuesday, January 11.

Microsoft is also facing a zero-day Internet Explorer vulnerability. Google security researcher Michael Zalewski notified Microsoft about the flaw in July, though his account of the notification process differs somewhat from Microsoft's.

On January 1, 2011, Microsoft issued a statement chiding Zalewski for failing to accommodate its request to delay the release of his security tool, cross_fuzz, which helped find the vulnerability. The company said that it is committed to working with companies and security researchers to resolve vulnerabilities before they're made public. "In this case, risk has now been amplified," said Jerry Bryant, group manager, response communications, Trustworthy Computing at Microsoft, in a statement.

Zalewski countered on his blog that at least one unknown party in China appeared to already know about the vulnerability, making disclosure necessary. Last summer, Zalewski was among the signatories of a Google blog post calling on the security community to update its disclosure practices.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-05-28
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
PUBLISHED: 2020-05-28
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
PUBLISHED: 2020-05-28
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time wi...
PUBLISHED: 2020-05-28
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
PUBLISHED: 2020-05-28
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.