News
Microsoft Patch Load Lightens for November
After two straight gargantuan rollouts, IT pros are getting a break with November's patch load.
This month's security update rollout will only have three patches: one "critical" and two "important." This may come as a welcome reprieve in a historic year for bulky security bulletin rollouts.
On this patch slate, products affected are Microsoft Office and Microsoft's Forefront Unified Access Gateway. One of the Microsoft Office vulnerabilities is rated "Critical" and affects all version of Office, including Office 2010.
There are two remote code execution risk factors and one elevation of privilege risk across the three patches, which are designed to plug 11 vulnerabilities.
Critical and Important Items
The lone critical item affects most modern service packs of Microsoft Office including Office XP, Office 2003, 2007 and 2010.
"A critical rating on an Office program is fairly rare," said Wolfgang Kandek, CTO of Qualys. "Most vulnerabilities on the Office suite are categorized as 'Important' because they typically require user interaction to get a successful exploitation. Critical here indicates a vulnerability that can be used to take control of the target machine without user interaction."
Meanwhile, the two important items touch Microsoft Office PowerPoint and Microsoft Forefront Unified Access Gateway respectively.
All three patches might require a restart.
No patch for Internet Explorer
One notable aspect of this month's rollout is that it doesn't seem likely that problems with Internet Explorer will be resolved with a patch before Thanksgiving, according to Paul Henry, Security Analyst for Lumension.
Microsoft released Security Advisory 2458511 on Wednesday, sharing guidance and mitigation regarding the in-the-wild bugs that Redmond said could impact Internet Explorer users "if they visit a Web site hosting malicious code."
"There continues to be no mention of the IE vulnerability that was found in the wild being used in 'drive-by' hacks that allow an attacker to perform a remote code execution, installing malware on the visiting user's system," said Paul Henry of Lumension. "It affects IE versions 6,7 and 8, while users of IE 9 Beta are safe."
Microsoft has published a workaround, for the mean time. Henry commented that Redmond is not expected to release an out-of-band patch until next month.
"It is interesting to note that Microsoft still doesn't believe it represents a significant threat, despite reports that it has been seen in the wild," said Henry.
About the Author
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.