Risk: Medium
Microsoft's first security patch roundup of 2005 brings with it three security updates, two of which are critical. Most importantly, the software giant has partially fixed a flaw with an HTML Help Control function in Windows, which recently became the target of a readily available exploit.
The security bug creates a way for attackers to take complete control of vulnerable systems. Win 2000, Win 2003, NT 4 and XP users - even those who've applied SP2 - need to apply Microsoft's fix (MS05-001). So far, public opinion has been less than exceptional, with several security firms stating that it is only a "partial fix" to the problem.
Also on Microsoft's critical list is an Icon and Cursor handling flaw, which can be exploited, providing vulnerable users are tricked into visiting maliciously constructed web sites (MS05-002). A flaw in the Windows indexing component rates lower on Microsoft's list chiefly because the service is turned off by default. The company says the patch (MS05-003) is "important".
January 2005's patches are also the first to be approved by the Security Update Validation Program. This is a small group of users who, behind a closed beta program, ensure that software fixes are stable and reliable, an issue that has been a common problem for Microsoft in the past.
Microsoft have also released their own version of an anti-spyware removal program, along the same lines as popular programs such as SpyBot & Ad-Aware. The software allows users to remove malicious content from their own systems, without having to purchase third-party programs.
The tool will be updated on the second Tuesday of every month. January's update removes Blaster, Sasser, MyDoom, DoomJuice, Zindos, Berweb (also known as Download.Ject), Gailbot and Nachi viruses/worms. Users can download the tool separately via the Microsoft web site or receive it through Windows Update.