Microsoft patches critical flaws

Microsoft has released eight new patches, five of which are rated 'critical' and could allow attackers to take complete control of compromised systems.

The vulnerabilities affect TCP/IP protocols, Internet Explorer, MSN Messenger, Microsoft Word and Microsoft Exchange server system. Microsoft warned of the impending updates on 11 April.

Users are advised to visit the Microsoft security website and update all software up to Windows 98.

Vulnerability management firm Qualys, which discovered the TCP/IP flaw, warned that other vendors will have to address the issue.

"We found the problem last October and notified Microsoft," said Gerhard Eschelbeck, chief technical officer at Qualys.

"The problem is that the standard is not particularly clear in how to deal with this, and different vendors have different solutions. Most of the vendors affected have released patches or will release patches in the coming days."

Cisco stated that it has already released a patch for the problem.

The three remaining patches, which affect Windows, are rated 'important' by Microsoft, and could allow remote control of PCs if used correctly.

The software giant is also re-releasing two security bulletins: MS05-002 for users running Windows 98, 98 Second Edition and Windows ME; and MS05-009 for users running Windows Messenger.