Microsoft Squashes Three Bugs, One 'Critical' In 2011's First Patch Tuesday

Microsoft slapped away three bugs, one the software giant considered "critical," with a pair of security bulletins this week with the first Patch Tuesday of 2011.

The critical bulletin, MS11-002, patched two Windows vulnerabilities that affect Microsoft Data Access Components (MDAC). One of the bugs was found in the way MDAC validates third party API usage, while the second was due to the way MDAC validates memory allocation. Both vulnerabilities could be exploited by maliciously crafted Web sites that let an attacker remotely execute code, Microsoft said.

Microsoft considered the MDAC vulnerability "critical" in XP, Vista and Windows 7, and important on Server 2003 and Server 2008. So far, Microsoft is unaware of any attacks leveraging the vulnerabilities or any proof of concept code to exploit them.

"The first vulnerability is rated Critical for Windows XP, Vista and Windows 7 and the second rated Important for all supported versions of Windows Server," wrote Carlene Chmaj, Microsoft senior security response communications manager in a blog post detailing the two Patch Tuesday security bulletins. "It involves the Microsoft Data Access Components (MDAC). This has an Exploitability Index rating of 1, and because there is a Web based attack vector, this is at the top of our deployment priority list."

Read more -here-