Researcher: Microsoft may launch 'month of ATL' patches on Tuesday
Advance notice offers clues Microsoft will update software hit by deep dev bug
Computerworld - Microsoft today said it would deliver nine security updates next Tuesday, all but one affecting Windows. Five are pegged "critical," the company's highest threat rating.
One researcher speculated that most of the updates will tackle bugs introduced when a Microsoft programmer added an extra "&" character to a vital code library.
Of the nine updates previewed today in the monthly advance notification, eight affect various versions of Windows, while the ninth deals with vulnerabilities in Office, Visual Studio, Internet Security and Acceleration Server (ISA Server), BizTalk Server and other products.
One of the eight Windows updates also affects what the bulletin dubbed "Client for Mac," and which Microsoft later confirmed refers to Remote Desktop Connection Client for Mac, software that lets Mac users connect to Windows-based machines.
In addition to the five critical updates, four are marked "important," the next rating down in the company's four-step scoring system.
"It won't be a go-take-a-nap month," said Andrew Storms, director of security operations at nCircle Network Security. "The good thing is that we're not looking at a lot [of vulnerabilities] in the public domain, so that should give everyone some time, a week or two at least, to test the updates before they deploy them."
One of the nine bulletins, however, appears to address the only unsolved issue Microsoft has publicly acknowledged: one or more flaws in its Microsoft Office Web Components (OWC). "The outstanding bug we know [exists] they disclosed July 13," Storms said. "And Bulletin 1 today is the only one that affects the Office Web Components. I'd say that Microsoft's on track to patch that this month."
Last month, Microsoft issued a security advisory related to OWC, saying that hackers were already exploiting an unpatched, critical vulnerability in a company-made ActiveX control, putting people running Internet Explorer (IE) at risk. The flawed ActiveX control is used by IE to display Excel spreadsheets in the browser.
Microsoft's advisory went out the day before its regularly-scheduled July batch of security updates; most analysts had not expected to see a fix make the July slate.
Storms' bet that Bulletin 1 will patch the problem seems safe. At the time it issued the advisory, Microsoft warned that users running Office XP, Office 2003, ISA 2004, ISA 2006 and Office Small Business Accounting 2006 were vulnerable to attack through IE. Today, Microsoft called out all those programs, as well as several others, as affected by the expected update.
It's also possible that several of the bulletins outlined today will update Microsoft software that previously contained flaws inherited from a buggy code library, said Storms.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts