Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
IE is AWOL from the patch list for the second month in a row
Computerworld - Microsoft Thursday said it will issue five security updates next week, two tagged as "critical," to close holes in Windows and the company's Exchange-based Forefront Protection 2010 security software.
Three of the four updates for Windows will affect Windows XP, the 13-year-old operating system that Microsoft plans to retire from patching support on April 8. After next week's Patch Tuesday, Microsoft has just two more rounds of security updates on its schedule before it pulls the plug on the aged OS.
One of the two critical updates -- and the only one that will apply to Windows -- does not even patch XP, according to Microsoft's typically-terse advanced notification published Thursday. Instead "Bulletin 1." as that update was tentatively labeled, will patch Windows 7, 8 and 8.1; Window RT and RT 8.1; and Windows Server 2008 R2, 2012 and 2012 R2. All are among the newer editions from Redmond.
"It's probably a classic [case] of something new added or some new bit of code introduced in newer versions," said Andrew Storms, director of DevOps at CloudPassage, explaining Bulletin 1's impact.
Two other Windows updates do affect XP, but both were rated as "important" on Microsoft's four-step scoring system, a level lower than critical. One could be used by attackers to obtain additional access right while the other could be used to snatch personal data from the compromised PC.
Also rated critical was the update for Forefront Protection 2010, a security and anti-spam program deployed on on-premises Exchange email servers. As usual, Microsoft provided no clues as to what the update will actually patch or where the vulnerability lies, but because Forefront is deployed on company-critical Exchange systems, it should be closely examined next week.
"This one is critical with [remote code execution] on Exchange, which is always going to get a lot of attention," said Storms. "It might just top our list next week, although we'll have to see the attack vector first."
Forefront Protection 2010 was one of a slew of Forefront-named products that Microsoft killed in December 2012. But although it has halted development and sales of Forefront Protection, it has promised to keep patching the program and delivering new signatures -- the fingerprint-like components that identify new malware or spam -- until the end of 2015.
But Storms and other security experts were almost as interested in what Microsoft would not patch next Tuesday as what it said yesterday it would fix.
"I nearly choked on my coffee when I saw no Internet Explorer update this month," said Storms about the omission of any patches for Microsoft's IE browser. "They went for years with at least an update every other month. And then a year of an update every month. Now none for 2 months in a row. Call it the blue moon, the black swan, whatever, but it's strange and a lot of people are wondering what is going on."
Storms dismissed the idea that Microsoft had run out of bugs to fix in IE, which according to Web metrics company Net Applications is used by more of the world's online population than any other, with a user share in January of 58.2%.
The lack of an IE update and the light load -- just five updates, following only four last month -- made him wonder if Microsoft's security and patching teams had taken a long vacation at the end of 2013. If so, it would have been a departure from the norm: In January 2013, Microsoft released 8 updates, with another 12 in February 2013.
Microsoft will have one more chance to patch bugs in IE before the Pwn2Own hacking contest starts next month. Pwn2Own, co-sponsored by Hewlett-Packard and Google, plans to give $100,000 to the first researcher or team able to compromise IE11 on a Windows 8.1-powered PC. An even larger prize of $150,000 awaits the first to hack the same setup when protected by Microsoft's Enhanced Mitigation Experience Toolkit (EMET), a utility that manually enables anti-exploit technologies.
Pwn2Own runs March 12-13, while Microsoft's Patch Tuesday for the month is set for March 11.
Microsoft will release next week's security updates on Feb. 11 around 1 p.m. ET.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org..> >
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Gartner Report: A Guide to Gartner's Enterprise Mobile Security Self-Assessment Gartner introduces a model and a Toolkit intended to help mobility and security IT leaders assess their enterprise mobility programs from a security...
- Gartner Report: Containing Mobile Security Risks With the 80/20 Rule IT planners can deliver better mobile protection with higher user satisfaction by segmenting users into risk groups before committing to specific management or...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts