Feeds

Clear next Tues: Incoming Outlook, IE, Windows critical security patches

Maybe the NSA doesn't need those remote execution holes any more

Build a business case: developing custom apps

Microsoft will squash 14 sets of security vulnerabilities - four of which are deemed critical - in the next edition of its monthly batch of Patch Tuesday updates, due next week.

Those four critical patches will address flaws in the Sharepoint server software, the Outlook component of Microsoft Office 2007 and 2010, Internet Explorer (versions 6, 7 and 8) and older versions of Windows (XP and Server 2003). All four critical bugs, plus four "important" ones, allow attackers to remotely execute code on a vulnerable system.

In fact, besides those four critical holes, all the remaining 10 so-called bulletins are rated "important". Redmond is holding off details on the vulnerabilities pending the delivery of fixes this coming Tuesday, so for now we only know which software packages are due to be fixed without knowing why they need updating.

Ziv Mador, director of security research at infosec firm Trustwave, said: "This month Microsoft continues the recent tradition of large Patch Tuesday with fourteen bulletins this month. No less than eight of them are categorised as remote code execution but only four of them are rated as critical."

In the first three quarters of 2013, Microsoft has issued 80 security patches, well ahead of the 63 released in the nine months to September 2012. "The increased numbers come from the important [bugs], not the critical [vulnerabilities]," notes Paul Henry, a security and forensics analyst at Lumension. "Microsoft told us this would be the case this year."

The vulnerability in Microsoft Office 2007 and 2010, which "can be triggered simply by previewing an email in Outlook, even without explicitly opening the email", obviously needs to be patched as soon as possible. The Internet Explorer fixes also need to be rushed through.

Microsoft's prerelease announcement can be found here. Additional comment from Wolfgang Kandek, CTO at cloud security firm Qualys, is here.

Tuesday will also mark the delivery of a critical update for Adobe's Reader and Acrobat PDF software packages. Adobe Reader/Acrobat XI (11.0.03) and earlier versions for Windows and Mac OS X as well as Adobe Reader/Acrobat X (10.1.7) and earlier 10.x for Windows and OS X will all need updating, as explained in an advisory by Adobe here. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.