Microsoft promises to stymie hackers next week with new patches

Also on Tuesday's books is a fix for the more recent ActiveX bug that hackers have been using since early June to hijack increasing numbers of Windows XP PCs. According to the researchers who discovered the bug, Microsoft has had details of the vulnerability for more than 12 months, and attacks have been conducted since at least June 9.

Earlier today, Mike Reavey, a director at MSRC, confirmed that Microsoft has known of the bug since the early spring of 2008, but denied that the company knew of in-the-wild attacks until last week. "We were made aware of the attacks only the day before we released the advisory," Reavey said.

The fix for the ActiveX vulnerability won't be a patch per se, said Reavey, but will instead be an automatic update that will set a large number of "kill bits" to disable the flawed control. The fix, then, will be the same as the manual workaround that Microsoft published Monday along with its advisory.

"This will block all known attacks," promised Reavey, who added that Microsoft will continue its work on a full-fledged patch, which will be released at some point in the future. He declined to say whether that patch would be delivered "out-of-cycle" -- outside the normal monthly update schedule -- when it is ready.

Knowing exactly what will be fixed is an added bonus for users, argued Storms, again pointing out how unusual it is for Microsoft to confirm patches in today's advance warning. "Knowing that that patch is coming out Tuesday, enterprises may halt their current efforts to deploy the workaround and just wait for the automatic update," he said.

"The rest of the updates are a smorgasbord, if you will," Storms said, when asked to describe the other four updates slated for delivery on Tuesday. "For the most part, it looks like we're back to the historical trend, where newer products have fewer risks."

But the big news is the fixes for the two zero-days, he repeated. "Everyone should be glad to see them," he said.

Microsoft will release the six updates at approximately 1 p.m. ET on July 14.

Read more about security in Computerworld's Security Knowledge Center.