Microsoft Patches 3 Security Holes

Microsoft issued three security bulletins this week fixing a critical flaw in DirectX, some important problems with SQL Server and a moderate security bug in Windows NT 4.0 Server.

The critical flaw in DirectX is a widespread problem affecting many versions of Windows. (See related story). The buffer overrun condition is exploited by sending a specially coded HTML e-mail or luring a user to a malicious Web page. Exploiting the problem is somewhat more difficult on systems running Windows Server 2003.

Microsoft rolled fixes for three newly discovered vulnerabilities in SQL Server into a new cumulative patch. The new SQL Server flaws require an authenticated user or a user on a local intranet to do the attacking. The bulletin describing the SQL Server problems is available at


Meanwhile, a flaw in a Windows NT 4.0 Server file management function permits a denial of service vulnerability. When the function receives a specially crafted request, the function can free memory that it doesn't own, causing the application passing the request to fail. Applications that are available remotely can use of the function, making it a problem that remote attackers can theoretically exploit.

Microsoft rates the problem a moderate risk. The bulletin and patch are available at

Microsoft puts out security bulletins on Wednesday evenings. It is the third consecutive week that Microsoft has released three security bulletins during its weekly update.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • How To Configure Windows 10 for Intel Optane Memory

    Intel's Optane memory technology can significantly improve the performance of your Windows 10 system -- provided you enable it correctly. A single mistake can render the system unbootable. Here's how to do it the right way.

  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

comments powered by Disqus