The score for MS patches: Moderate 2 Critical 1

By Alun Williams

Posted on 17 Oct 2002 at 10:43

Not one but three security bulletins from Microsoft, involving SQL Server, Word and Excel and the notorious Windows XP Help file deletion vulnerability.

In Security Bulletin MS02-060, Microsoft returns to the vulnerability where the Windows XP Help system can be tweaked to delete a file of the attacker's choice.

Rated only as a 'Moderate' problem, this was addressed in Windows XP Service Pack 1, which was released at the start of September. Microsoft has finally responded to criticism that the patch should be available outside of SP1.

You can download the patch from Microsoft's Web site.

Another vulnerability - described in Microsoft Security Bulletin MS02-059 and rated as 'Moderate' - relates to the use of field codes in Word and external updates in Excel. These are a mechanism by which data from one document can be inserted into another, for example the automatic insertion of a disclaimer paragraph in a legal document.

It seems a specially crafted field code or external update can be used to 'steal' information without the user's knowledge. The attacker could create a document that - when opened - updates itself with the contents of a file from the user's computer.

Affected software comprises Word 2002, Word 2000, Word 97, Word 98, Word X for Macintosh, Word 2001 for Macintosh, Word 98 for Macintosh and Excel 2002. Locations for patches are given within the Security Bulletin.

Finally, the vulnerability relating to SQL Server involves 'elevation of privilege' and is described in Microsoft Security Bulletin MS02-061. By the use of stored procedures it is possible for an attacker to run Web tasks.

You can download the patch here for Microsoft SQL Server 7.0 and here for Microsoft SQL Server 2000. They are cumulative fixes that include all previously released patches for SQL Server 7.0, SQL Server 2000, and Microsoft Data Engine (MSDE) 1.0, Microsoft Desktop Engine (MSDE) 2000.