Feeds

Clear next Tues: Incoming Outlook, IE, Windows critical security patches

Maybe the NSA doesn't need those remote execution holes any more

Intelligent flash storage arrays

Microsoft will squash 14 sets of security vulnerabilities - four of which are deemed critical - in the next edition of its monthly batch of Patch Tuesday updates, due next week.

Those four critical patches will address flaws in the Sharepoint server software, the Outlook component of Microsoft Office 2007 and 2010, Internet Explorer (versions 6, 7 and 8) and older versions of Windows (XP and Server 2003). All four critical bugs, plus four "important" ones, allow attackers to remotely execute code on a vulnerable system.

In fact, besides those four critical holes, all the remaining 10 so-called bulletins are rated "important". Redmond is holding off details on the vulnerabilities pending the delivery of fixes this coming Tuesday, so for now we only know which software packages are due to be fixed without knowing why they need updating.

Ziv Mador, director of security research at infosec firm Trustwave, said: "This month Microsoft continues the recent tradition of large Patch Tuesday with fourteen bulletins this month. No less than eight of them are categorised as remote code execution but only four of them are rated as critical."

In the first three quarters of 2013, Microsoft has issued 80 security patches, well ahead of the 63 released in the nine months to September 2012. "The increased numbers come from the important [bugs], not the critical [vulnerabilities]," notes Paul Henry, a security and forensics analyst at Lumension. "Microsoft told us this would be the case this year."

The vulnerability in Microsoft Office 2007 and 2010, which "can be triggered simply by previewing an email in Outlook, even without explicitly opening the email", obviously needs to be patched as soon as possible. The Internet Explorer fixes also need to be rushed through.

Microsoft's prerelease announcement can be found here. Additional comment from Wolfgang Kandek, CTO at cloud security firm Qualys, is here.

Tuesday will also mark the delivery of a critical update for Adobe's Reader and Acrobat PDF software packages. Adobe Reader/Acrobat XI (11.0.03) and earlier versions for Windows and Mac OS X as well as Adobe Reader/Acrobat X (10.1.7) and earlier 10.x for Windows and OS X will all need updating, as explained in an advisory by Adobe here. ®

Internet Security Threat Report 2014

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.