Tweet
In what is becoming an all-too-common occurrence, Microsoft (Nasdaq: MSFT) has revealed new security vulnerabilities: three in Windows Media Player and Windows XP , plus four in its Commerce Server line.
The company has issued patches and recommendations for countering the security flaws, but even so, the revelation comes at a time when users, the industry and law enforcement are all in a state of heightened awareness.
For example, the Federal Bureau of Investigation (FBI) recently warned that computer-savvy Al Qaeda members may be planning to use the Internet to carry out terrorist attacks against nuclear power plants, dams and parts of the United States' infrastructure.
Even putting aside terrorist threats, attacks against software code have cost companies and others US$13.2 billion, according to Computer Economics.
Leaky Security
Microsoft has had a busy spring plugging potential security holes in its products. The company issues about 60 security advisories each year, and Microsoft chairman Bill Gates has called for an end to Microsoft's longstanding practice of rushing feature-rich software to market without testing adequately for security flaws.
Giga Information Group vice president Julie Giera has told the E-Commerce Times that Microsoft "realizes that without security and user confidence, the potential damage to its market and brand name is tremendously large."
Profile Flaw
One of the current batch of flaws centers on an unchecked buffer in the software giant's Profile Service, which helps users manage data in their profiles and check order status.
The buffer is designed to handle some API (application programming interface) calls. According to Microsoft, a hacker could provide corrupt data that would cause Commerce Server 2000 to fail.
To exploit the vulnerability, a Commerce Server site must be set up to include Profile Service calls. Microsoft noted that deploying the URLscan tool with the default ruleset in play can lessen or eliminate the threat presented by this flaw, as can limiting the kind of user input that is accepted.
Proposed Remedy
Another flaw, this one in the buffer overrun of the Office Web Components installer, also could allow hackers to disrupt Commerce Server 2000.
But Microsoft said that for a hacker to be successful, he or she would need credentials to log onto the computer housing the OWC installer.
Another OEC vulnerability lets a hacker assume privileges and run commands in Commerce Server 2000. Once again, the attacker would need access to the computer that stores the OWC installer.
To offset both threats, Microsoft suggested that enterprises "not be allowed to interactively log onto business-critical servers."
Both Commerce Server 2000 and 2002 also are vulnerable to a new variation of an ISAPI Filter weakness previously addressed by Microsoft.
Minimal Threat
While the company said it would be possible for an attacker to launch denial-of-service attacks, "URLScan tool, if deployed using the default ruleset for Commerce Server, would make it difficult if not impossible for an attacker to exploit the vulnerability to run code, by significantly limiting the types of data that could be included in a URL."
Additionally, the Media Player security holes revealed by Microsoft could, among other things, provide hackers with ample opportunity to manipulate data.
This latest revelation concerning security flaws comes on the heels of Microsoft's commitment to its Palladium initiative, a comprehensive plan to boost security.
The company has issued patches and recommendations for countering the security flaws, but even so, the revelation comes at a time when users, the industry and law enforcement are all in a state of heightened awareness.
For example, the Federal Bureau of Investigation (FBI) recently warned that computer-savvy Al Qaeda members may be planning to use the Internet to carry out terrorist attacks against nuclear power plants, dams and parts of the United States' infrastructure.
Even putting aside terrorist threats, attacks against software code have cost companies and others US$13.2 billion, according to Computer Economics.
Leaky Security
Microsoft has had a busy spring plugging potential security holes in its products. The company issues about 60 security advisories each year, and Microsoft chairman Bill Gates has called for an end to Microsoft's longstanding practice of rushing feature-rich software to market without testing adequately for security flaws.
Giga Information Group vice president Julie Giera has told the E-Commerce Times that Microsoft "realizes that without security and user confidence, the potential damage to its market and brand name is tremendously large."
Profile Flaw
One of the current batch of flaws centers on an unchecked buffer in the software giant's Profile Service, which helps users manage data in their profiles and check order status.
The buffer is designed to handle some API (application programming interface) calls. According to Microsoft, a hacker could provide corrupt data that would cause Commerce Server 2000 to fail.
To exploit the vulnerability, a Commerce Server site must be set up to include Profile Service calls. Microsoft noted that deploying the URLscan tool with the default ruleset in play can lessen or eliminate the threat presented by this flaw, as can limiting the kind of user input that is accepted.
Proposed Remedy
Another flaw, this one in the buffer overrun of the Office Web Components installer, also could allow hackers to disrupt Commerce Server 2000.
But Microsoft said that for a hacker to be successful, he or she would need credentials to log onto the computer housing the OWC installer.
Another OEC vulnerability lets a hacker assume privileges and run commands in Commerce Server 2000. Once again, the attacker would need access to the computer that stores the OWC installer.
To offset both threats, Microsoft suggested that enterprises "not be allowed to interactively log onto business-critical servers."
Both Commerce Server 2000 and 2002 also are vulnerable to a new variation of an ISAPI Filter weakness previously addressed by Microsoft.
Minimal Threat
While the company said it would be possible for an attacker to launch denial-of-service attacks, "URLScan tool, if deployed using the default ruleset for Commerce Server, would make it difficult if not impossible for an attacker to exploit the vulnerability to run code, by significantly limiting the types of data that could be included in a URL."
Additionally, the Media Player security holes revealed by Microsoft could, among other things, provide hackers with ample opportunity to manipulate data.
This latest revelation concerning security flaws comes on the heels of Microsoft's commitment to its Palladium initiative, a comprehensive plan to boost security.
Comment