Two zero-day vulnerabilities, one reported last week, will be fixed in Microsoft's monthly patch release next week.
Moving with uncharacteristic speed, Microsoft plans to fix what it has called a "browse-and-get-owned" vulnerability in its Video ActiveX Control when it releases its July software patches next week.
The company acknowledged the vulnerability last week. It is also planning to fix a second "browse-and-get-owned" vulnerability in its DirectShow software that was disclosed in May.
Both of these flaws affect older version of Windows; Windows Vista and Windows Server 2008 are not affected.
'[O]ur engineering teams have been working around the clock to produce an update for [the Microsoft Video ActiveX Control vulnerability] and we believe that they will be able to release an update of appropriate quality for broad distribution that protects against the attacks we detailed in the advisory," said Jerry Bryant, senior security program manager at Microsoft, in a blog post on Thursday.
Microsoft said in an advanced summary of its upcoming July 14 security patch that it plans to release six security bulletins.
Three will be "critical" updates for Windows, one of which affects Windows Vista and Windows Server 2008. There will also be one "important" update for Publisher, one "important" update for Internet Security and Acceleration (ISA) Server, and one "important" update for Virtual PC and Virtual Server.
Security vendors Trend Micro and Websense have noted that the ActiveX flaw is being actively exploited on Web sites in China.
"Around 967 Chinese Web sites are reported to be infected by a malicious script that leads users to successive site redirections and lands them to download a .JPG file containing the exploit," said Trend Micro security engineer Roland Dela Paz in a blog post.
And Bryant said that Microsoft is aware of limited attempts to exploit the DirectShow vulnerability.
Read more about:
2009About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024