Both vulnerabilities could allow an attacker to gain complete control over vulnerable PCs or servers running the Microsoft software, the company said in two security bulletins, released as part of its monthly patching cycle.
The Windows problem lies in the way the software processes Web fonts and affects all current versions of the operating system. A vulnerable Windows system could be compromised if the user opened an e-mail or visited a Web site containing a malicious font, Microsoft said in security bulletin MS06-002.
Outlook and Exchange are flawed in the way the applications decode certain e-mail messages, Microsoft said in security bulletin MS06-003. An attacker could craft a malicious e-mail message, and vulnerable systems would be compromised when the message is processed by Exchange or viewed by the Outlook user.
Both vulnerabilities were reported privately to Microsoft, which has not discovered any current cyberattacks that use the flaws as a conduit. Patches to repair the bugs are available via the online bulletins, and the company urges people to install those as soon as possible.
Broken Windows
Tuesday is Microsoft's first official Patch Tuesday of 2006. However, the company broke its monthly patching program last week to deliver a fix for another serious flaw in Windows. That bug, related to the way the operating system renders Windows Meta File images, is being used in exploits, experts have said.
On Monday, two new Windows image problems were reported on a popular e-mail list. Microsoft acknowledged those issues, but said they are performance problems, not security vulnerabilities.
The new Exchange and Outlook vulnerability affects all current versions of the software except Exchange 2003 with Service Pack 1 or Service Pack 2, Microsoft said. The issue is specific to the processing of mail that uses the Transport Neutral Encapsulation Format protocol, used in sending messages in Rich Text Format. For temporary protection, Exchange users could block TNEF, Microsoft suggested.
The Windows problem was discovered and reported by eEye Digital Security, and the Exchange and Outlook flaw was found by Next Generation Security Software.
