Microsoft ends year with critical security alert

Microsoft has released its last regular security update of the year which includes five new patches, all rated 'important', and the reissue of a 'critical' patch after extensive revisions.

Patch 28 fixes a buffer overrun vulnerability in the software that handles JPEG files in Outlook, IE6, Windows XP, Server 2003, .Net 1.0 SP2 and .Net 1.1. Users are advised to download the patch and install it immediately.

Windows XP SP2 users are not immune, as three of the patches are needed on their systems. All Windows PC and server operating systems are affected by the updates.

All NT 4 systems will need the patches, and one addresses only that operating system. It covers flaws in the Dynamic Host Configuration Protocol that could allow a PC to be taken over or taken down in a denial of service attack.

Also patched is a vulnerability in Microsoft's HyperTerminal that could allow a hacker to craft a file that would exploit the flaw when clicked.

Since HyperTerminal is not automatically installed with Windows Server 2003 the patch is rated 'moderate' for that system.

Full details and downloads can be found on www.microsoft.com/security.

These patches bring the total for the year to 45, compared with 51 for 2003. But this masks the fact that most of the patches are for multiple vulnerabilities.