Risk: High
Two newly discovered 'highly critical' vulnerabilities in Microsoft programs enable remote code execution. One of the issues is in Internet Explorer and the other in Windows Media Player. The flaw in Internet Explorer allows malicious users to create a WMF file that would execute remote code if a user visits a malicious website or opens a malicious email attachment. Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 is affected and Microsoft recommends installing updates as a matter of urgency.
The other highly critical flaw has been discovered in Windows Media Player. By taking advantage of the way that Media Player handles bitmap images, a hacker can construct a malicious bitmap file to enable remote code execution when a user visits a website or opens it as an attachment.
The other Microsoft flaws are classified as 'important' by Microsoft and could result in denial of service, remote code execution, privilege elevation and information disclosure in a variety of programs. One affected program is Powerpoint, but the flaw can be fixed by installing the update from Microsoft's website. The Information Disclosure vulnerability could enable a hacker to access Temporary Internet Files, which could provide information for a hacker to attempt to compromise the affected system.
Remote code execution flaws have been found in the Windows Web Client Service and Windows Media Player. The Web Client Service vulnerability could allow an attacker to take complete control of an affected system, however, the hacker would need to have valid logon credentials and be able to log on locally to exploit the vulnerability. The Windows Media Player flaw exists in non-Microsoft Internet browsers and arises when the plug-in handles a malformed EMBED element. An attacker could potential take control of a system by creating a malicious EMBED element to allow remote code execution.
There is also a new TCP/IP vulnerability, which if exploited, could result in denial of service, through an attacker sending a specially crafted IGMP packet.
The final flaw highlighted in the February bulletin addresses a new risk discovered in Windows and Office Korean Input Method Editor (IME). The issue lies with an attacker being able to take control of an entire system by exploiting a privilege escalation vulnerability; but the user would have to be able to interactivity log onto the affected system.