Microsoft Patch Load Lightens for November

After two straight gargantuan rollouts, IT pros are getting a break with November's patch load.

This month's security update rollout will only have three patches: one "critical" and two "important." This may come as a welcome reprieve in a historic year for bulky security bulletin rollouts.

On this patch slate, products affected are Microsoft Office and Microsoft's Forefront Unified Access Gateway. One of the Microsoft Office vulnerabilities is rated "Critical" and affects all version of Office, including Office 2010.

There are two remote code execution risk factors and one elevation of privilege risk across the three patches, which are designed to plug 11 vulnerabilities.

Critical and Important Items
The lone critical item affects most modern service packs of Microsoft Office including Office XP, Office 2003, 2007 and 2010.

"A critical rating on an Office program is fairly rare," said Wolfgang Kandek, CTO of Qualys. "Most vulnerabilities on the Office suite are categorized as 'Important' because they typically require user interaction to get a successful exploitation. Critical here indicates a vulnerability that can be used to take control of the target machine without user interaction."

Meanwhile, the two important items touch Microsoft Office PowerPoint and Microsoft Forefront Unified Access Gateway respectively.

All three patches might require a restart.

No patch for Internet Explorer
One notable aspect of this month's rollout is that it doesn't seem likely that problems with Internet Explorer will be resolved with a patch before Thanksgiving, according to Paul Henry, Security Analyst for Lumension.

Microsoft released Security Advisory 2458511 on Wednesday, sharing guidance and mitigation regarding the in-the-wild bugs that Redmond said could impact Internet Explorer users "if they visit a Web site hosting malicious code."

"There continues to be no mention of the IE vulnerability that was found in the wild being used in 'drive-by' hacks that allow an attacker to perform a remote code execution, installing malware on the visiting user's system," said Paul Henry of Lumension. "It affects IE versions 6,7 and 8, while users of IE 9 Beta are safe."

Microsoft has published a workaround, for the mean time. Henry commented that Redmond is not expected to release an out-of-band patch until next month.

"It is interesting to note that Microsoft still doesn't believe it represents a significant threat, despite reports that it has been seen in the wild," said Henry.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus


  • Entity Framework Core 6: What Developers Want

    Microsoft outlined its plan for Entity Framework Core 6, which in November will take its place as the data access component of the landmark .NET 6, a long-term support (LTS) release that will mark Microsoft's transition from the Windows-only .NET Framework to an open source, cross-platform umbrella offering of all things .NET.

  • AWS Open Sources .NET Porting Assistant GUI

    After previously open sourcing components of its Porting Assistant for .NET, Amazon Web Services open sourced the tool's GUI.

  • .NET Core Ranks High Among Frameworks in New Dev Survey

    .NET Core placed high in a web-dominated ranking of development frameworks published by CodinGame, which provides a tech hiring platform.

  • Here's a One-Stop Shop for .NET 5 Improvements

    Culled from reams of Microsoft documentation, here's a high-level summary of what's new for performance, networking, diagnostics and more, along with links to the nitty-gritty details for those wanting to dig in more.

Upcoming Events