Microsoft Sets New Patch Record, Fixes 26 Flaws
The flaws, more than half of which received a "critical" rating, run the gamut from Internet Explorer to Word, Excel, and PowerPoint.All the Office updates affect not only various versions on Windows, but also Mac Office 2004 and Mac Office v. X. Mac users can update from within the suite, or by downloading the appropriate patch at Microsoft's Mactopia Web site.
But the update that both Leatham and nCircle's Hamilton thought deserved first place in the patching order wasn't one of the 4 for Office, but instead MS06-061, a fix for the XML parser and XML core services within Windows. This critical update, said both researchers, should be patched pronto.
"The XSLT buffer overrun is critical across the board, Windows 2000, XP, and Server 2003," said Hamilton. "This one will be great for phishing and Web hacking because of the prevalence of XML and the ease of exploit."
Leatham agreed, and then some. "This one is really, really concerning us. I'd expect this to be a prime vulnerability that will definitely be targeted for exploit. Click on the wrong link and you're infected."
The problem, according to Microsoft's notes on the vulnerability, is compounded by a lack of workarounds or factors that might minimize the threat. Microsoft had no workarounds to offer up other than to patch, and the only way to guarantee safety is to surf only trusted sites.
"All an attacker has to do is build a page, get people there, and if XML is running, the buffer's overrun and remote code can be downloaded," said Leatham.
Other bulletins issued Tuesday quash bugs in the Server service; the next-generation TCP/IP protocol, IPv6; and .Net Framework 2.0. None of those updates were marked higher than important, Microsoft's second-from-the-top threat ranking.
One update, however, went missing Tuesday. Last week, in its regular Thursday-before-patch-day announcement, Microsoft said it would issue 11 bulletins, 6 of which would affect Windows. Tuesday saw 10 bulletins, with only 5 for Windows.
"We found an issue in our testing after the Thursday notification in one of
the Windows Updates that caused us to remove that update from the release
channel while we put it through additional testing," a Microsoft
spokesperson said. "[We] will make it available in the next release cycle
once it reaches the quality bar."
Microsoft has reason to hesitate, said Hamilton, who noted the firm has had
to re-release updates recently. The quality of its August batch was especially
suspect; Microsoft had to reissue three different bulletins from that
month, including one that was revised twice.
Users can obtain Tuesday's patches via Windows' Automatic Update, from the Microsoft Update service, or through other Microsoft software and services, including the enterprise-grade Windows Server Update Services (WSUS) and Software Update Services (SUS).
We welcome your comments on this topic on our social media channels, or
[contact us directly] with questions about the site.

2 of 2

More Insights