Microsoft Sets New Patch Record, Fixes 26 Flaws - InformationWeek
04:09 PM

Microsoft Sets New Patch Record, Fixes 26 Flaws

The flaws, more than half of which received a "critical" rating, run the gamut from Internet Explorer to Word, Excel, and PowerPoint.

All the Office updates affect not only various versions on Windows, but also Mac Office 2004 and Mac Office v. X. Mac users can update from within the suite, or by downloading the appropriate patch at Microsoft's Mactopia Web site.

But the update that both Leatham and nCircle's Hamilton thought deserved first place in the patching order wasn't one of the 4 for Office, but instead MS06-061, a fix for the XML parser and XML core services within Windows. This critical update, said both researchers, should be patched pronto.

"The XSLT buffer overrun is critical across the board, Windows 2000, XP, and Server 2003," said Hamilton. "This one will be great for phishing and Web hacking because of the prevalence of XML and the ease of exploit."

Leatham agreed, and then some. "This one is really, really concerning us. I'd expect this to be a prime vulnerability that will definitely be targeted for exploit. Click on the wrong link and you're infected."

The problem, according to Microsoft's notes on the vulnerability, is compounded by a lack of workarounds or factors that might minimize the threat. Microsoft had no workarounds to offer up other than to patch, and the only way to guarantee safety is to surf only trusted sites.

"All an attacker has to do is build a page, get people there, and if XML is running, the buffer's overrun and remote code can be downloaded," said Leatham.

Other bulletins issued Tuesday quash bugs in the Server service; the next-generation TCP/IP protocol, IPv6; and .Net Framework 2.0. None of those updates were marked higher than important, Microsoft's second-from-the-top threat ranking.

One update, however, went missing Tuesday. Last week, in its regular Thursday-before-patch-day announcement, Microsoft said it would issue 11 bulletins, 6 of which would affect Windows. Tuesday saw 10 bulletins, with only 5 for Windows.

"We found an issue in our testing after the Thursday notification in one of the Windows Updates that caused us to remove that update from the release channel while we put it through additional testing," a Microsoft spokesperson said. "[We] will make it available in the next release cycle once it reaches the quality bar."

Microsoft has reason to hesitate, said Hamilton, who noted the firm has had to re-release updates recently. The quality of its August batch was especially suspect; Microsoft had to reissue three different bulletins from that month, including one that was revised twice.

Users can obtain Tuesday's patches via Windows' Automatic Update, from the Microsoft Update service, or through other Microsoft software and services, including the enterprise-grade Windows Server Update Services (WSUS) and Software Update Services (SUS).

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
2017 State of IT Report
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends for 2018
As we enter a new year of technology planning, find out about the hot technologies organizations are using to advance their businesses and where the experts say IT is heading.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll