Microsoft fixed security issues in Microsoft Office, Internet Explorer, Exchange and other applications on Tuesday during the software giant's regularly scheduled May update.
The patches close 19 holes, including seven flaws in Microsoft Office, six flaws in Internet Explorer and a critical vulnerability in the remote procedure call (RPC) management interface for Microsoft's Domain Name Service (DNS) server which is currently being used by malicious software to compromise systems. The flaws in Microsoft Office include three flaws in Excel and another three in Word. While the flaws are rated Critical for Office 2000, only four affect Office 2007 and are rated only Important.
Microsoft's older versions of Office have increasingly been targeted by attackers intent on stealing information from corporations and government agencies in the U.S., Canada, the U.K., Australia, and other nations. The software giant has had a to-do list of nearly a half dozen flaws, and sometimes more, since earlier this year.
However, Microsoft's latest Office version, Office 2007, has largely been unscathed due to the company's focus on security during development -- a process known as the Secure Development Lifecycle, Joshua Edwards, technical product manager for Microsoft's Office team, said in an interview earlier this month.
"We are hardening the crypto; we are removing the buffer overruns," Edwards said. "As a result, we are seeing a reduction in the number of potential issues."
Microsoft closed six vulnerabilities in Internet Explorer, of which two are rated critical for Internet Explorer 7 running on the company's latest operating system Windows Vista. Microsoft also fixed four vulnerabilities in its Exchange mail and messaging server, including a critical flaw in the way the program handles MIME e-mail attachments.
As part of its normal advanced notification process, the software giant warned last Thursday that it would be releasing two fixes for Windows, three for its Office productivity suite and one each for its Exchange mail and messaging server and its Biztalk process management server.
