News

Microsoft Patch Load Lightens for November

After two straight gargantuan rollouts, IT pros are getting a break with November's patch load.

This month's security update rollout will only have three patches: one "critical" and two "important." This may come as a welcome reprieve in a historic year for bulky security bulletin rollouts.

On this patch slate, products affected are Microsoft Office and Microsoft's Forefront Unified Access Gateway. One of the Microsoft Office vulnerabilities is rated "Critical" and affects all version of Office, including Office 2010.

There are two remote code execution risk factors and one elevation of privilege risk across the three patches, which are designed to plug 11 vulnerabilities.

Critical and Important Items
The lone critical item affects most modern service packs of Microsoft Office including Office XP, Office 2003, 2007 and 2010.

"A critical rating on an Office program is fairly rare," said Wolfgang Kandek, CTO of Qualys. "Most vulnerabilities on the Office suite are categorized as 'Important' because they typically require user interaction to get a successful exploitation. Critical here indicates a vulnerability that can be used to take control of the target machine without user interaction."

Meanwhile, the two important items touch Microsoft Office PowerPoint and Microsoft Forefront Unified Access Gateway respectively.

All three patches might require a restart.

No patch for Internet Explorer
One notable aspect of this month's rollout is that it doesn't seem likely that problems with Internet Explorer will be resolved with a patch before Thanksgiving, according to Paul Henry, Security Analyst for Lumension.

Microsoft released Security Advisory 2458511 on Wednesday, sharing guidance and mitigation regarding the in-the-wild bugs that Redmond said could impact Internet Explorer users "if they visit a Web site hosting malicious code."

"There continues to be no mention of the IE vulnerability that was found in the wild being used in 'drive-by' hacks that allow an attacker to perform a remote code execution, installing malware on the visiting user's system," said Paul Henry of Lumension. "It affects IE versions 6,7 and 8, while users of IE 9 Beta are safe."

Microsoft has published a workaround, for the mean time. Henry commented that Redmond is not expected to release an out-of-band patch until next month.

"It is interesting to note that Microsoft still doesn't believe it represents a significant threat, despite reports that it has been seen in the wild," said Henry.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus

Featured

  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

  • Visual Studio 2019 v16.8 Preview Update Adds Codespaces

    To coincide with the Microsoft Ignite 2020 IT pro/developer event, the Visual Studio dev team shipped a new update, Visual Studio 2019 v16.8 Preview 3.1, with the main attraction being support for cloud-hosted Codespaces, now in a limited beta.

  • Speed Lines Graphic

    New for Blazor: Azure Static Web Apps Support

    With Blazor taking the .NET web development world by storm, one of the first announcements during Microsoft's Ignite 2020 developer/IT event was its new support in Azure Static Web Apps.

  • Entity Framework Core 5 RC1 Is Feature Complete, Ready for Production

    The first release candidate for Entity Framework 5 -- Microsoft's object-database mapper for .NET -- has shipped with a go live license, ready for production.

Upcoming Events