Skip to navigation
Latest News

The score for MS patches: Moderate 2 Critical 1

By Alun Williams

Posted on 17 Oct 2002 at 10:43

Not one but three security bulletins from Microsoft, involving SQL Server, Word and Excel and the notorious Windows XP Help file deletion vulnerability.

In Security Bulletin MS02-060, Microsoft returns to the vulnerability where the Windows XP Help system can be tweaked to delete a file of the attacker's choice.

Rated only as a 'Moderate' problem, this was addressed in Windows XP Service Pack 1, which was released at the start of September. Microsoft has finally responded to criticism that the patch should be available outside of SP1.

You can download the patch from Microsoft's Web site.

Another vulnerability - described in Microsoft Security Bulletin MS02-059 and rated as 'Moderate' - relates to the use of field codes in Word and external updates in Excel. These are a mechanism by which data from one document can be inserted into another, for example the automatic insertion of a disclaimer paragraph in a legal document.

It seems a specially crafted field code or external update can be used to 'steal' information without the user's knowledge. The attacker could create a document that - when opened - updates itself with the contents of a file from the user's computer.

Affected software comprises Word 2002, Word 2000, Word 97, Word 98, Word X for Macintosh, Word 2001 for Macintosh, Word 98 for Macintosh and Excel 2002. Locations for patches are given within the Security Bulletin.

Finally, the vulnerability relating to SQL Server involves 'elevation of privilege' and is described in Microsoft Security Bulletin MS02-061. By the use of stored procedures it is possible for an attacker to run Web tasks.

You can download the patch here for Microsoft SQL Server 7.0 and here for Microsoft SQL Server 2000. They are cumulative fixes that include all previously released patches for SQL Server 7.0, SQL Server 2000, and Microsoft Data Engine (MSDE) 1.0, Microsoft Desktop Engine (MSDE) 2000.

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

From around the web

Be the first to comment this article

You need to Login or Register to comment.

(optional)

advertisement

Most Commented News Stories
More From PC Pro
Latest Blog Posts Subscribe to our RSS Feeds
Latest ReviewsSubscribe to our RSS Feeds
Latest Real World Computing

advertisement

Sponsored Links
 
SEARCH
SIGN UP

Your email:

Your password:

remember me

advertisement


Hitwise Top 10 Website 2010
 
 

PCPro-Computing in the Real World Printed from www.pcpro.co.uk

Register to receive our regular email newsletter at http://www.pcpro.co.uk/registration.

The newsletter contains links to our latest PC news, product reviews, features and how-to guides, plus special offers and competitions.