Microsoft Patches Critical Security Flaw Affecting All Versions of Windows

By Tara Seals October 14, 2015

Microsoft has issued a critical patch for all supported versions of Windows, to address a remote code execution flaw in Internet Explorer.

If exploited, an attacker could gain access to an affected machine, gaining the same access rights as the logged-in user. From there, he or she could wreak havoc, deleting data or installing malware on the machine.

The problem lies with how Internet Explorer handles objects in memory, Microsoft said.

In order to be successful, an attacker would need to carry out a social engineering campaign to lure IE users to a specific website, or convince them to open an infected attachment. A website itself could host malicious content designed to exploit the vulnerability, or, the attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements.

In all cases, however, an attacker would have to convince users to take action, typically by getting them to click a link in an instant message or e-mail message that takes users to the attacker's Website or downloads the file.

Image via Shutterstock

"These Websites could contain specially crafted content that could exploit the vulnerabilities,” said the advisory.

Windows Vista and later, including Windows 10, are at risk; Windows server systems are also at risk, but its enhanced security mode helps to mitigate the vulnerability.

The update was issued as part of Microsoft’s monthly Patch Tuesday release. While Microsoft released six security bulletins in all, resolving a total of 19 vulnerabilities, the IE bug is the most severe. However, half of the security bulletins are critical, and all of the critical bulletins (MS15-106, MS15-108, MS15-109) are remote code execution issues affecting not just IE but also the Edge browser, VBScript & JScript Engines, Windows Shell, Office, Office Services and apps, as well as Microsoft Server Software. That’s a good chunk of the ecosystem, and admins should apply the patches as quickly as possible.

Edited by Maurice Nagle

Contributing Writer

Related Articles

Why People Don't Update Their Computers

By: Special Guest    7/13/2018

When the WannaCry ransomware attacked companies all over the world in 2017, experts soon realized it was meant to be stopped by regular updating. Even…

Read More

More Intelligence About The New Intelligence

By: Rich Tehrani    7/9/2018

TMC recently announced the launch of three new artificial intelligence events under the banner of The New Intelligence. I recently spoke with TMC's Ex…

Read More

Technology, Innovation, and Compliance: How Businesses Approach the Digital Age

By: Special Guest    6/29/2018

Organizations must align internally to achieve effective innovation. Companies should consider creating cross-functional teams or, at a minimum, incre…

Read More

Contribute Your Brain Power to The New Intelligence

By: Paula Bernier    6/28/2018

The three events that are part of The New Intelligence are all about how businesses and service providers, and their customers, can benefit from artif…

Read More

TMC Launches The New Intelligence - an Unparalleled AI and Machine Learning Conference & Expo in Florida

By: TMCnet News    6/28/2018

TMC announced the launch of The New Intelligence conference and expo - The Event Powering the AI Revolution. This exciting new event will take place o…

Read More