Second Microsoft VM Flaw Found

Microsoft Corp. this week turned its recent patch for the Microsoft Virtual Machine into a cumulative patch.

A second critical flaw was discovered in the Microsoft Virtual Machine that could allow a malicious user to create a Java applet that executes code on a user's machine outside the Java "sandbox."

This adds to a critical flaw that prompted Microsoft to issue the patch in the first place at the beginning of March. That flaw could allow an attacker to view information on a user's machine. The original flaw only affected Internet Explorer users browsing behind proxy servers, a category that includes most of the corporate world.

The more recently discovered vulnerability is a variant of the Virtual Machine Verifier bug that Microsoft addressed in a 1999 patch. An attacker must post the malicious Java applet on a Web site and entice a user to execute the applet for the attack to work. Once the applet runs, the only constraints on the attacker's ability to execute code is the user's privileges.

The Microsoft Virtual Machine is available for all current Windows clients back to Windows 95 and all versions of Internet Explorer.

The Microsoft VM figures prominently in the lawsuit Sun Microsystems recently filed against Microsoft.

Microsoft's security bulletin is located at

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

  • Microsoft FastTrack Support Extended to Microsoft 365 Defender Solutions

    The Microsoft FastTrack support program has been extended to Microsoft 365 Defender products for certain qualified subscribers, Microsoft indicated this week.

comments powered by Disqus