Microsoft plans patches for 'hacker's playground'
Slates at least 14 bug fixes for Exchange, SQL Server, Windows, Office; will update IE for third month running
Computerworld - Microsoft today said it will patch at least 14 vulnerabilities next week, including four in Internet Explorer (IE), making it three months in a row that the company has plugged holes in its browser.
Of the nine updates set for Aug. 14, five will be labeled "critical," the most serious of the four ratings Microsoft uses. The other four will be pegged "important," the next-lower threat ranking.
The big story for next week will be the one-two punch of patches for Exchange and SQL Server.
"Those are two of the three things that are most important to IT in enterprises," said Andrew Storms, director of security operations at nCircle Security. "Thank goodness SharePoint's not included. But Microsoft is hitting two out of three in just one month."
In the advanced notification of next week's updates, Microsoft outlined patches for Exchange, the email server software used by most companies, and SQL Server, the database that runs many corporations' internal and external processes, including powering websites and providing workers with everything from business intelligence to financial information.
The problem with patching those systems -- Exchange and SQL Server -- is their criticality to business, said Storms.
"In most companies, security and operations are split into two groups," said Storms. "That sets up a classic conflict. Security cares about patching, operations cares about uptime."
Some firms deal with the conflict by running a lab where the security team can replicate the firm's production systems and use those for patch testing. Other companies rely on redundancy to prevent a company-wide failure of email and databases.
In any case, IT administrators like to go slowly when dealing with Exchange and SQL Server to ensure that updates don't cause unexpected downtime. "It could take some enterprises months to patch all their Exchange nodes," Storms said.
The last time Microsoft patched any version of Exchange was December 2010, when it updated Exchange Server 2007. The update set for next week will affect Exchange Server 2007 and the current Exchange Server 2010.
"And it's not like you can ignore the Exchange patch," said Storms. "It's a zero-day."
Storms was referring to the security advisory Microsoft issued July 24 that warned of critical vulnerabilities in code licensed from Oracle that could give attackers access to Exchange Server 2007 and Exchange Server 2010 systems.
Oracle patched the vulnerabilities in its "Oracle Outside In" code libraries as part of a massive update on July 17 that fixed nearly 90 flaws.
Along with the Exchange, SQL Server and IE updates, others will address bugs in Windows, Office and Visual Basic, the company's widely-used development platform.
The IE update will be the third in three months for the browser: Microsoft also patched IE in June and July.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts