Microsoft plans colossal Patch Tuesday next week

Computerworld - Microsoft today said it will deliver a record 16 security updates next week to patch a whopping 49 vulnerabilities in Windows, Internet Explorer (IE), Office and SharePoint.

Andrew Storms, director of security operations for nCircle Security, called the massive update "daunting, again."

Four of the 16 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step scoring system. Another 10 were marked "important," the second-highest rating, while the remaining pair were labeled as "moderate."

Nine of the updates could be exploited by attackers to inject malicious code into vulnerable PCs, Microsoft said in its usual bare-bones advance notification of the updates scheduled for release Oct. 12. Microsoft often labels remote code executable bugs -- the most dangerous -- as important when the vulnerable components are not switched on by default or when other mitigating factors, such as defensive measures like ASLR and DEP, may protect some users.

Next week's Patch Tuesday is a record on almost every count.

The 16 updates -- Microsoft dubs them "bulletins" -- are a record, beating the count from August 2010 by two. The 49 individual patches easily exceeds the single-month record of 34, which was first set in October 2009 and repeated in this past June and August.

Microsoft has been shipping alternating large and small batches of fixes, with the larger-sized updates landing in even-numbered months, so October's big numbers shouldn't come as a shock. In August, for example, the company issued 14 bulletins patching 34 vulnerabilities. September's batch, however, included 9 bulletins that fixed 11 flaws.

"I have a theory about the large October updates," said Storms, pointing out that Microsoft released 13 bulletins and patched 34 vulnerabilities in the month last year, and issued 12 updates and fixed 21 flaws in October 2008. "It's the year-end financial and retail push by most companies, which go into lockdown mode the last two months of the year, when they don't update their systems," he said.

Twelve of the 16 bulletins are aimed at Windows, either the desktop or server editions, or in some cases both. Two from next week's slate affect Office -- Word and Excel, specifically -- and are likely patches for one or more file format vulnerabilities in those applications, said Storms.

One of the bulletins will address a problem in SharePoint, Microsoft's enterprise-grade collaboration server software. According to the advance notification, the SharePoint update will be related in some way to Office Web Apps, the online editions of Microsoft's Word, Excel, PowerPoint and OneNote applications.

Other than the sheer number of updates users will have to apply, Storms also noted that several apply to the newest versions of Microsoft's operating system, Windows 7 on the desktop and Windows Server 2008 R2 on the server side.