Microsoft Sets New Patch Record, Fixes 26 Flaws - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

04:09 PM

Microsoft Sets New Patch Record, Fixes 26 Flaws

The flaws, more than half of which received a "critical" rating, run the gamut from Internet Explorer to Word, Excel, and PowerPoint.

All the Office updates affect not only various versions on Windows, but also Mac Office 2004 and Mac Office v. X. Mac users can update from within the suite, or by downloading the appropriate patch at Microsoft's Mactopia Web site.

But the update that both Leatham and nCircle's Hamilton thought deserved first place in the patching order wasn't one of the 4 for Office, but instead MS06-061, a fix for the XML parser and XML core services within Windows. This critical update, said both researchers, should be patched pronto.

"The XSLT buffer overrun is critical across the board, Windows 2000, XP, and Server 2003," said Hamilton. "This one will be great for phishing and Web hacking because of the prevalence of XML and the ease of exploit."

Leatham agreed, and then some. "This one is really, really concerning us. I'd expect this to be a prime vulnerability that will definitely be targeted for exploit. Click on the wrong link and you're infected."

The problem, according to Microsoft's notes on the vulnerability, is compounded by a lack of workarounds or factors that might minimize the threat. Microsoft had no workarounds to offer up other than to patch, and the only way to guarantee safety is to surf only trusted sites.

"All an attacker has to do is build a page, get people there, and if XML is running, the buffer's overrun and remote code can be downloaded," said Leatham.

Other bulletins issued Tuesday quash bugs in the Server service; the next-generation TCP/IP protocol, IPv6; and .Net Framework 2.0. None of those updates were marked higher than important, Microsoft's second-from-the-top threat ranking.

One update, however, went missing Tuesday. Last week, in its regular Thursday-before-patch-day announcement, Microsoft said it would issue 11 bulletins, 6 of which would affect Windows. Tuesday saw 10 bulletins, with only 5 for Windows.

"We found an issue in our testing after the Thursday notification in one of the Windows Updates that caused us to remove that update from the release channel while we put it through additional testing," a Microsoft spokesperson said. "[We] will make it available in the next release cycle once it reaches the quality bar."

Microsoft has reason to hesitate, said Hamilton, who noted the firm has had to re-release updates recently. The quality of its August batch was especially suspect; Microsoft had to reissue three different bulletins from that month, including one that was revised twice.

Users can obtain Tuesday's patches via Windows' Automatic Update, from the Microsoft Update service, or through other Microsoft software and services, including the enterprise-grade Windows Server Update Services (WSUS) and Software Update Services (SUS).

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
2 of 2
Comment  | 
Print  | 
More Insights
State of the Cloud
State of the Cloud
Cloud has drastically changed how IT organizations consume and deploy services in the digital age. This research report will delve into public, private and hybrid cloud adoption trends, with a special focus on infrastructure as a service and its role in the enterprise. Find out the challenges organizations are experiencing, and the technologies and strategies they are using to manage and mitigate those challenges today.
IT Careers: Top 10 US Cities for Tech Jobs
Cynthia Harvey, Freelance Journalist, InformationWeek,  1/14/2020
Predictions for Cloud Computing in 2020
James Kobielus, Research Director, Futurum,  1/9/2020
What's Next: AI and Data Trends for 2020 and Beyond
Jessica Davis, Senior Editor, Enterprise Apps,  12/30/2019
Register for InformationWeek Newsletters
Current Issue
The Cloud Gets Ready for the 20's
This IT Trend Report explores how cloud computing is being shaped for the next phase in its maturation. It will help enterprise IT decision makers and business leaders understand some of the key trends reflected emerging cloud concepts and technologies, and in enterprise cloud usage patterns. Get it today!
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll