Feeds

MS January patch update omits critical Word fix

Half measures

Providing a secure and efficient Helpdesk

Microsoft released four patches on Tuesday - half the number initially expected - that address a number of critical flaws in its Windows OS, Outlook and Office software.

None of the three is critical and one important security fix published by Microsoft addresses a trio of Word flaws, which have been left flapping since early December.

One of the patches Microsoft did release addresses a slew of vulnerabilities in Excel that create a means for hackers to load malware onto vulnerable systems (MS07-002).

Another critical patch (MS07-003) addresses flaws in Microsoft Outlook that carries a similar risk while the last of the trio aims to lance security bugs in Microsoft's implementation of Vector Markup Language in Windows ((MS07-004) that also carry the risk of remote code execution.

Redmond also released a fix for a less severe (important) bug in Microsoft Office 2003's Brazilian Portuguese grammar checker.

Security vendors reckon the need to test the Word patches more comprehensively is behind Redmond's decision to hold back these fixes.

"Microsoft held back on four anticipated patches prior to general release this month. Instead, Microsoft released half of what it promised - three sets of critical patches and one important patch, fixing nine security bugs. While this may come as a surprise to some IT administrators, Microsoft is taking a cautionary approach with its patch release to ensure minimal business impact and disruption to its customers," said Alan Bentley, managing director of patch management firm PatchLink.

"Testing patches is absolutely critical but an often overlooked element of patch management process. Microsoft did the right thing in holding back the four patches that most likely didn’t pass the QA(Quality Assurance) testing before releasing them to its large user base," he added.

Since exploits are available for the Outlook and VML flaws applying patches that address these security flaws ought to be the main priority for sys admins, PatchLink advises.

Microsoft's summary of its security patches can be found here and there's more information of the relative severity of the vulnerabilities, via the SANS Institute's Internet Storm Centre here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.