Microsoft warns of monster patch day next week

Computerworld - Microsoft Corp. today said it will issue eight security updates on Tuesday, the most since October 2008, to patch problems in Windows, Internet Explorer (IE), DirectX, Excel, Word and the company's security software.

Five of the eight updates will be labeled "critical," Microsoft's highest ranking in its four-step threat system, today's notice said, while two will be pegged "important," the next rating down, and one marked "moderate."

"It's going to be a difficult month to set priorities for patching," argued Andrew Storms, director of security operations at nCircle Network Security Inc. "There are updates for Windows, one that's critical across the board, a browser update that affects everyone and an Office update. That's a lot of different groups to juggle."

Five of the eight updates will address flaws in Windows, with other updates tackling vulnerabilities in IE, Excel and the Internet Security and Acceleration server software. Three of the five Windows updates have been tagged critical, as have the IE and Excel updates.

The Excel update is probably a patch for the vulnerability in the spreadsheet program that Microsoft acknowledged nearly two months ago, said Storms. In late February, Microsoft issued a security advisory warning users that attacks were already in circulation, adding that all supported versions of Excel, including the latest -- Excel in Office 2007 on Windows and in Office 2008 for the Mac -- were affected.

At the time, Microsoft told users they could protect themselves by blocking Excel files from opening, a process that requires editing the Windows registry, or by running Excel 2003 documents through the Microsoft Office Isolated Conversion Environment, a tool the company launched in 2007.

Microsoft did not patch the Excel bug last month when it released its regularly scheduled updates on March 10.