MS warns of 3 'critical' flaws

Reed Stevenson

SEATTLE - Microsoft Corp. warned of three "critical"-rated flaws in the Windows operating system and other programs, that could allow hackers to sneak into personal computers and snoop on sensitive data.

The security warning was announced with another software vulnerability rated "important" as part of Microsoft's monthly security bulletin.

The warning was issued with a software patch that fixes the problem on Windows operating systems dating back to Windows 98, as well as software that is part of Internet Explorer and the Outlook express e-mail program.

"People should continue to understand that they should update (their software) as soon as possible," said Vincent Gullotto, vice president of the anti-virus emergency response team at Network Associates Inc.

Microsoft is urging customers to use its Windows Update service to have the security patches downloaded and installed automatically, while Gullotto said that large companies with extensive Windows systems should adopt the patches as soon as possible.

"At the corporate level they're going to have a lot of work ahead of them," Gullotto said, noting that the larger the organization, the costlier it could be.

Stephen Toulouse, a manger at Microsoft's Security Response Center, said that customers should "apply these updates to protect their systems from an attacker who might seek to exploit them."

The flaws could allow attackers to break into PCs running Windows in several ways and then use the system to run malicious programs and steal or delete key data, Toulouse said.

Toulouse said that all of the security bulletins would be included in an upcoming software update for Windows XP called Service Pack 2, and that the update would also include "changes to the fundamental architecture that helps make it more secure."

The free update to Windows XP, which has been described by Microsoft executives as an important software offering to enhance security in the latest version of Windows, is due out in the summer or fall.

Last year, Microsoft adopted a new monthly patch release program, which it said would let customers apply software fixes for security bugs more easily.

Two years ago, Microsoft Chairman Bill Gates pledged to make Microsoft's software products more secure and reliable under an initiative dubbed "Trustworthy Computing."

Outlook Express, the e-mail program that is included in Windows, is also affected by one of the security flaws, Microsoft said.

@Reuters