The Channel logo


By | John Leyden 12th May 2010 09:54

Office and Mail bugs star in May Patch Tuesday update

Devil in the detail

Microsoft released just two updates on Tuesday as part of a light patch Tuesday, especially in comparison with April's 11 bulletins.

May's batch contains a fix (MS10-030) for a critical vulnerability in Windows Outlook Express, Windows Mail and Windows Live Mail. Left unchecked, the vulnerability created a mechanism for remote code execution.

In practice, however, a fair bit of user interaction would probably be needed to pull off an attack. Even though Redmond defines the update as critical the vulnerability is not being actively exploited by hackers. It affects applications most frequently used by consumers and small businesses.

The second bulletin (MS10-03) covers a remote code execution flaw in supported versions of Microsoft Office, and is labelled as "important".

A recently discovered vulnerability in Microsoft's SharePoint enterprise portal software was not addressed by the latest batch of security updates. Wolfgang Kandek, CTO at vulnerability scanning firm Qualys, commented: "We recommend looking into the advisory and implementing the suggested work-around which restricts the access to the Help functionality in SharePoint."

Alan Bentley, VP International for Lumension, warned that newly discovered vulnerabilities in third-party browser software pose a threat to Windows users.

“A new Safari vulnerability that impacts Windows remains un-patched and Proof of Concept Code (POC) is freely downloadable on the Internet. The biggest concern here is that Safari is often installed silently when a user chooses to install QuickTime on their Windows PC," Bentley said.

Microsoft's summary of its May Patch Tuesday can be found here. The Internet Storm Centre's rather more readable overview is here. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe