26 Windows, Office holes patched in 13 bulletins

One of the patches is for a remote code exploit in MSPaint. I am at a loss for words.

 

unique way to attack a computer but doesn't really surprise me, I've seen scripts that cause adobe to instantly open and exploit adobe, I'm sure similar could be done to mspaint.

interesting info also JRViejo

 

This is because the user's browser is configured to use the Adobe Plugin to open the PDF file in the browser, hence, auto-exploitation. However, the browser can be easily configured to prompt for a download of the file, rather than using the plugin:

​

Users with such configuration cannot be victims of this type of auto-exploitation from web-based scripts.

It's not likely that the MSPaint exploit would work with a script in a web page, since JPG files load by default into the browser; otherwise, we wouldn't see JPG images on a web site:

​

And so, the likely scenario, as Microsoft describes it:

Microsoft Security Bulletin MS10-005
http://www.microsoft.com/technet/security/Bulletin/MS10-005.mspx

You may recall the WMF exploit that targeted a vulnerability in the Windows Picture and Fax viewer , where a web-based script did work, because WMF files do open in that program by default, and not in the browser.

----
rich

 

One of the patches (MS10-015: KB977165) had to be recalled. Its causing the BSOD in some XP machines.

http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/73cea559-ebbd-4274-96bc-e292b69f2fd1

http://www.computerworld.com/s/arti...serving_Windows_patch_blamed_for_blue_screens

 

Thanks. It seems I was sleeping at the terminal.

I should have known the Wilders bunch would have been on top of this right away.