Microsoft promises huge patch day next week
Slates 11 updates for Windows, IE, Active Directory, Office and Host Integration Server
Computerworld - Microsoft Corp. today said it will issue 11 security updates next week -- the same number it shipped in August when it pushed out the most patches in 18 months -- to fix bugs in Windows, Active Directory, Internet Explorer (IE), Office and Host Integration Server.
Four of the 11 updates will be labeled "critical," Microsoft's highest threat ranking, with six pegged "important," the next-lowest rating, and one tagged as "moderate."
As is Microsoft's practice, it released only the most general information about the upcoming security patches in the advance notification it posted Thursday. Among the details that the company provided are the affected software, the severity of the security problem and the components involved.
Seven of the 11 updates will address vulnerabilities that Microsoft acknowledged can be used to execute remote code, a description that generally means hackers could exploit those vulnerabilities to inject their own malicious code into vulnerable PCs, often by convincing users to open a file attachment or tricking them into visiting a rogue Web site. All four of the critical updates were marked with Microsoft's "Remote Code Execution" label, as were three of the important bulletins.
Bugs in Active Directory, IE, Excel and Microsoft Host Integration Server were all tagged critical.
The Active Directory fix will apply only to Windows 2000 Server, said Microsoft, which has patched the component several times, most recently in June when it fixed a broader problem in validating client LDAP requests.
On the other hand, the patch for Host Integration Server (HIS) is a first for that software, a little-known enterprise product that connects Windows-based networks to the IBM mainframe and AS/400 systems. HIS 2000, HIS 2004 and HIS 2006 are all affected, said Microsoft.
Based on the versions affected, the Excel update will likely patch a file format problem; both Windows and Mac editions of the spreadsheet program will have to be patched, said Microsoft. When that has happened in the past, the update has usually addressed file format bugs.
The IE patch, meanwhile, will fix flaws rated critical in IE5 and IE6, but which Microsoft ranked as only important for the newer IE7. According to Danish bug tracker Secunia, which lists several vulnerabilities in IE that need attention, the most-pressing problem is a cross-domain scripting bug in IE6 reported more than three months ago.
Other updates, including all six marked important, will address bugs in various versions of Windows; the one bulletin labeled moderate affects only Office XP Service Pack 3 (SP3).
In a related note, Microsoft said last month that Tuesday's updates would be the last for Office 2003 SP2; after next week, the company will only support that version of Office as Service Pack 3.
Microsoft will release the 11 security updates at approximately 1 p.m. EST on Oct. 14.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts