Microsoft released a pair of patches on Tuesday - including a cumulative security fix for IE deemed "critical" - as part of its regular monthly patching schedule. The IE update (MS05-054) deals with four security vulnerabilities including two flaws which create a means for ne'er do wells to run hostile code on vulnerable systems, including one that has become the subject of a hacker-friendly exploit. All Windows users with all supported flavours of IE are urged to apply the update.
The browser uber-patch also deals with the fallout from Sony BMG's controversial use of flawed digital rights management software (First4Internet's XCP program). The browser update makes it impossible to run First4Internet XCP uninstallation ActiveX control, a piece of code designed to remove the DRM software but which was found to create worse security problems than it attempted to solve.
Microsoft also released a patch to address a privilege-elevation flaw in Windows 2000 (MS05-055). Attacks based on the vulnerability would need local access to vulnerable machines, however it's still serious enough to be described as an "important" security update. The flaw was discovered by security firm eEye on May 23 - 204 days ago - and involves a locally exploitable kernel-level vulnerability. "Although not remotely exploitable in-and-of itself, a malicious user, network worm or email virus could take advantage of this vulnerability in order to completely compromise a vulnerable system on which the exploit code is executing, regardless of that code's original privilege level," eEye notes. ®