|MS10- 016||975561||Vulnerability in Windows Movie Maker Could Allow Remote Code Execution||Remote Code Execution||Microsoft Windows||Moviemaker: CVE-2010-0265||Important|
|MS10-017||980150||Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution||Remote Code Execution||Microsoft Office||Excel:CVE-2010-0257|
MS10-016 - Vulnerabilities associated with Windows Movie Maker are present when a user opens a Windows Movie Maker file. Many organizations probably do not have this software deployed or used; However, Movie Maker is built-in to some versions of Windows Vista making uninstallation difficult. So even if you are not using Movie Maker, you still need to apply the patches; please search to confirm if you have it installed. What is interesting is that an attacker can just Google for Windows Movie Maker with a query for "running version" and can find hosted forums for users who post topics looking for help and talking about the specific (vulnerable) version of Movie Maker. An attacker only needs to associate the forum user ID or email with the target and a potentially successful attack could then be started to be carried out.
MS10-017 - Seven vulnerabilities in Microsoft Excel are being fixed. It is interesting to see that CVE-2010-0263 was disclosed to Microsoft last year July 14, 2009 and now just being fixed almost 8 months later. Core Security reported CVE-2010-0243 on September 4, 2009 just over 6 months ago and also being addressed now. The vulnerability itself does not execute remote code or exploit remotely accessible network services; However, thinking outside the box - an attacker can produce specifically targeted attacks with the help of the following Google query:
Last Updated: 03/11/2010