Microsoft wraps year with big security update

December 15, 2010 By Geoff Duncan

Microsoft's monthly security update for December fixed 40 vulnerabilities in WIndows, Office, Internet Explorer, SharePoint Server, and Exchange.

Microsoft is giving its customers a reassuring present for the holidays: a substantial security update that addresses 40 vulnerabilities across 17 bulletins in Microsoft Windows, Office, and Internet Explorer, along with server-based systems like SharePoint Server and Exchange. Among the fixes are five critical and two moderate patches for all versions of Internet Explorer, including a fix for a bug that could enable attackers to execute arbitrary code using invalid flag references in Cascading Style Sheets (CSS) used to specify how Web pages should be displayed.

The update also fixes a critical problem with Windows’ OpenType Font driver and patches the last known vulnerability being exploited by the infamous Stuxnet malware.

Microsoft first warned users about the CSS vulnerability in Internet Explorer in early November; although the problem applies to Internet Explorer 6, 7, and 8, Microsoft says IE6 and IE7 users saw the most impact. Other security fixes in Internet Explorer fix holes taht could enable attackers to take over a computer when a user simply loads a malicious Web site. Although the CSS vulnerability has been used in the wild, Microsoft says it’s not aware of any real world attacks that exploited the other vulnerabilities. Similarly, Microsoft does not know of any cases where the OpenType vulnerability was exploited.

The sizable security updates follows a comparatively sedate November, which consisted of only three patches. Security experts are concerned that with both consumers and businesses distracted by the end-of-year holidays, they may defer installing Microsoft’s latest round of patches—which not only fixes more problems, but addresses at least one major vulnerability that is out there in the wild.

Showing 4 comments

Clint at 11:08pm 15th December 2010 @ dc in KC I had a lot of calls on this also, funny most of them had firefox or chrome on their computer so I just had them use a different browser to get online.
captaingrumpy at 3:52pm 15th December 2010 I think it's becoming clearer with more updates that they tend to rush these items into service before they are fine tuned.This creates problems that add to the worries of the user into deciding whether to update or not. As with downloads like 'Trend', if it creates hassles you just uninstall the latest update,but with IE,it's a bit more involved.
dc in KC at 12:05pm 15th December 2010 What they don't tell you is that the update put in place for IE has rendered it quite useless. I am an Internet Helpdesk Technician, and 90% of my calls today have been in regards to IE not displaying pages. A simple IE (7&8) reset does the trick, however. Thanks for keeping me employed MSFT. -dc
Janice Taylor at 11:19am 15th December 2010 Check out the book "I.T. Wars" (it's on Amazon). We use it at work for new employee orientation - and we refresh ourselves whenever updating policy. Lotsa great stuff. Author also has a GREAT blog, (Google to) "The Business-Technology Weave."