12 Microsoft patches coming
Connecting state and local government leaders
Critical patches will be issued for various Windows OS versions and applications, including Internet Explorer, Access, Windows Media Player and Office.
IT professionals and system administrators can expect to be busy this month as Microsoft announced yesterday that it plans to release 12 patches for its monthly security bulletin rollout. Seven of these patches will be critical and five will be deemed important when released on Patch Tuesday next week, Redmond says.
The critical patches will touch on a cornucopia of programs, including various Windows OS versions and applications such as Internet Explorer, Access, Windows Media Player and Microsoft Office. The updates to Office will include individual patches for PowerPoint and Excel, for which Microsoft has issued several hotfixes and advisories in the last year.
Of the five important patches, four will affect Windows and one will plug vulnerabilities in Office. There will be fixes for Outlook Express, Windows Mail and Windows Messenger.
The remote code execution (RCE) vulnerability is being addressed by all but three of the fixes contained in this month's patch. The remaining three fixes address what Redmond is calling "information disclosure" vulnerabilities.
Critical Issues
The first critical fix affects Microsoft Windows 2000, Windows XP Service Packs 2 and 3 and all versions of Windows Server 2003. It is designed, as all other critical fixes are this month, to combat RCE.
Meanwhile, critical fix number two will affect all versions of Internet Explorer sitting on every extant Microsoft operating system (from Microsoft 2000 to Windows XP, Vista and Windows Server 2003 and 2008).
The third critical fix will affect Windows Media Player, used for streaming video and audio. The applicable OS versions are Windows Server 2008 for 32- and 64-bit systems as well as Vista and Windows XP.
Microsoft Access is the application in question for the fourth critical fix, with fixes for versions running on the Vista and Windows Server 2008 operating systems. Fix No. 5 is systemic and is a comprehensive patch for Excel on all Windows OS versions.
The last two critical fixes address PowerPoint and Microsoft Office for all Windows operating systems currently in circulation.
Important Items
Important fix No. 1 is an across-the-board Windows OS security patch with information disclosure implications. "Information disclosure" is a problem that means just what it says. Hackers can gain access to critical data and use it for their own aims.
The second important patch also affects all Windows operating systems and is made to keep RCE exploits at bay.
The disclosure vulnerabilities of Outlook Express (Versions 5 and 6) and Windows Mail are addressed by the third important fix in this month's patch. Outlook is only being fixed if it touches Windows 2000 SP4, Windows XP and Windows Server 2003. Windows Mail is only being fixed if it touches Vista and Windows Server 2008.
The next important item affects Windows Messenger 4.7 and 5.1. It is also an information disclosure fix, designed to secure the application on every OS except Vista and Windows Server 2008.
The fifth and final patch for this section is a Microsoft Word fix designed for XP SP3 and Microsoft Office 2003 SP2 and SP3. RCE exploits are the issue here too.
This hefty patch slate comes as Microsoft is shoring up its efforts for greater transparency in the security hotfix space. Beginning with its October patch release rollout cycle, the software giant will provide an assessment of risk for the vulnerabilities outlined in each security bulletin. The aim is to help administrators prioritize patch installation.
Of the 12 patches, seven will require restarts.
Since this spring, Microsoft has asked IT pros to consult a monthly knowledgebase article to find out about new nonsecurity content releases in Windows Update and Windows System Update Services. On tap this month on the nonsecurity front are junk mail filters, Windows Home Server Power Pack 1 and comprehensive updates to Windows Server 2008, Vista, XP and Windows Server 2003.
NEXT STORY: Legal support for security researchers