Microsoft Sets New Patch Record, Fixes 26 Flaws - InformationWeek
04:09 PM

Microsoft Sets New Patch Record, Fixes 26 Flaws

The flaws, more than half of which received a "critical" rating, run the gamut from Internet Explorer to Word, Excel, and PowerPoint.

All the Office updates affect not only various versions on Windows, but also Mac Office 2004 and Mac Office v. X. Mac users can update from within the suite, or by downloading the appropriate patch at Microsoft's Mactopia Web site.

But the update that both Leatham and nCircle's Hamilton thought deserved first place in the patching order wasn't one of the 4 for Office, but instead MS06-061, a fix for the XML parser and XML core services within Windows. This critical update, said both researchers, should be patched pronto.

"The XSLT buffer overrun is critical across the board, Windows 2000, XP, and Server 2003," said Hamilton. "This one will be great for phishing and Web hacking because of the prevalence of XML and the ease of exploit."

Leatham agreed, and then some. "This one is really, really concerning us. I'd expect this to be a prime vulnerability that will definitely be targeted for exploit. Click on the wrong link and you're infected."

The problem, according to Microsoft's notes on the vulnerability, is compounded by a lack of workarounds or factors that might minimize the threat. Microsoft had no workarounds to offer up other than to patch, and the only way to guarantee safety is to surf only trusted sites.

"All an attacker has to do is build a page, get people there, and if XML is running, the buffer's overrun and remote code can be downloaded," said Leatham.

Other bulletins issued Tuesday quash bugs in the Server service; the next-generation TCP/IP protocol, IPv6; and .Net Framework 2.0. None of those updates were marked higher than important, Microsoft's second-from-the-top threat ranking.

One update, however, went missing Tuesday. Last week, in its regular Thursday-before-patch-day announcement, Microsoft said it would issue 11 bulletins, 6 of which would affect Windows. Tuesday saw 10 bulletins, with only 5 for Windows.

"We found an issue in our testing after the Thursday notification in one of the Windows Updates that caused us to remove that update from the release channel while we put it through additional testing," a Microsoft spokesperson said. "[We] will make it available in the next release cycle once it reaches the quality bar."

Microsoft has reason to hesitate, said Hamilton, who noted the firm has had to re-release updates recently. The quality of its August batch was especially suspect; Microsoft had to reissue three different bulletins from that month, including one that was revised twice.

Users can obtain Tuesday's patches via Windows' Automatic Update, from the Microsoft Update service, or through other Microsoft software and services, including the enterprise-grade Windows Server Update Services (WSUS) and Software Update Services (SUS).

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
2018 State of the Cloud
2018 State of the Cloud
Cloud adoption is growing, but how are organizations taking advantage of it? Interop ITX and InformationWeek surveyed technology decision-makers to find out, read this report to discover what they had to say!
Tech Vendors to Watch in 2019
Susan Fogarty, Editor in Chief,  11/13/2018
Getting DevOps Wrong: Top 5 Mistakes Organizations Make
Bill Kleyman, Writer/Blogger/Speaker,  11/2/2018
AI & Machine Learning: An Enterprise Guide
James M. Connolly, Executive Managing Editor, InformationWeekEditor in Chief,  9/27/2018
Register for InformationWeek Newsletters
Current Issue
The Next Generation of IT Support
The workforce is changing as businesses become global and technology erodes geographical and physical barriers.IT organizations are critical to enabling this transition and can utilize next-generation tools and strategies to provide world-class support regardless of location, platform or device
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll