Microsoft Sets New Patch Record, Fixes 26 Flaws

All the Office updates affect not only various versions on Windows, but also Mac Office 2004 and Mac Office v. X. Mac users can update from within the suite, or by downloading the appropriate patch at Microsoft's Mactopia Web site.

But the update that both Leatham and nCircle's Hamilton thought deserved first place in the patching order wasn't one of the 4 for Office, but instead MS06-061, a fix for the XML parser and XML core services within Windows. This critical update, said both researchers, should be patched pronto.

"The XSLT buffer overrun is critical across the board, Windows 2000, XP, and Server 2003," said Hamilton. "This one will be great for phishing and Web hacking because of the prevalence of XML and the ease of exploit."

Leatham agreed, and then some. "This one is really, really concerning us. I'd expect this to be a prime vulnerability that will definitely be targeted for exploit. Click on the wrong link and you're infected."

The problem, according to Microsoft's notes on the vulnerability, is compounded by a lack of workarounds or factors that might minimize the threat. Microsoft had no workarounds to offer up other than to patch, and the only way to guarantee safety is to surf only trusted sites.

"All an attacker has to do is build a page, get people there, and if XML is running, the buffer's overrun and remote code can be downloaded," said Leatham.

Other bulletins issued Tuesday quash bugs in the Server service; the next-generation TCP/IP protocol, IPv6; and .Net Framework 2.0. None of those updates were marked higher than important, Microsoft's second-from-the-top threat ranking.

One update, however, went missing Tuesday. Last week, in its regular Thursday-before-patch-day announcement, Microsoft said it would issue 11 bulletins, 6 of which would affect Windows. Tuesday saw 10 bulletins, with only 5 for Windows.

"We found an issue in our testing after the Thursday notification in one of the Windows Updates that caused us to remove that update from the release channel while we put it through additional testing," a Microsoft spokesperson said. "[We] will make it available in the next release cycle once it reaches the quality bar."

Microsoft has reason to hesitate, said Hamilton, who noted the firm has had to re-release updates recently. The quality of its August batch was especially suspect; Microsoft had to reissue three different bulletins from that month, including one that was revised twice.

Users can obtain Tuesday's patches via Windows' Automatic Update, from the Microsoft Update service, or through other Microsoft software and services, including the enterprise-grade Windows Server Update Services (WSUS) and Software Update Services (SUS).

2 of 2